Troubleshooting

When publishing or webhook delivery fails: a red alert with the fix appears on the Articles page, the org owner gets a "Publishing to {domain} needs attention" email, and Settings flags Integrations with a "Failing" badge.

Cloudflare or WAF blocking publishing

Cloudflare (or another firewall) can classify Grandranker's requests as bot traffic and block them (403/503) — "Cloudflare is blocking publishing" or "Cloudflare blocked the request" on webhooks.

Fix

1. Cloudflare → Security → WAF → Tools → IP Access Rules.
2. Add 65.21.252.91 with action Allow.
3. Or create a WAF custom rule that skips security checks for your webhook or /wp-json/ path.
4. Retry: Retry publish on the article alert, or Send Test on Webhooks.

Other WAFs (Sucuri, Wordfence, AWS WAF): same fix — whitelist 65.21.252.91.

WordPress REST API errors

WordPress publishing goes through /wp-json/. Use Test connection on the WordPress integration to diagnose.

"Invalid credentials" / HTTP 401

• Use the WordPress user_login (Users → All Users, "Username" column) — not email or display name.
• If your host strips the Authorization header, add to .htaccess and regenerate the Application Password:

CopyRewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]

"WordPress REST API is not reachable"

A security plugin or host firewall is blocking /wp-json/. Whitelist the path and IP 65.21.252.91, confirm https://yoursite.com/wp-json/ loads in a browser.

"Access forbidden" / HTTP 403

Connect with an Administrator account.

"WordPress REST API not found" / HTTP 404

Wrong site URL, or a plugin disabled the REST API. Verify the URL and re-enable it.

"Not allowed to create posts as this user"

Your site rejects Application Password logins. Install the Grandranker WordPress plugin instead — it publishes without them, and queues articles for pull delivery if your site blocks inbound requests. See WordPress.

Webhook delivery failures

A delivery succeeds only on a 2xx response. Failures retry up to 3 times; after 5 consecutive failures the webhook auto-disables. Delivery History shows each attempt. Send Test diagnoses live:

• Domain not found: check the URL for typos; must be publicly accessible.
• Connection refused: server running, port correct (include non-standard ports), inbound allowed.
• Request timed out: must respond within 30 seconds and be reachable from the public internet.
• SSL/TLS error: renew expired certs, include the full chain. Self-signed certs can disable SSL verification on the webhook.
• Authentication error (401/403): accept Authorization: Bearer <token> — copy it via View Access Token.
• Endpoint not found (404): route path must match exactly, including trailing slashes.
• Method not allowed (405): endpoint must accept POST.
• Server error (5xx): check server logs, confirm the endpoint parses the JSON payload.

Retry from Delivery History once fixed, and flip Status back on if auto-disabled. Full setup: Webhooks.