iThemes Security (renamed to Solid Security) blocks REST API access by default. One setting fixes it.
Set REST API to Default Access
- Solid Security → Settings → WordPress Tweaks.
- Find REST API.
- Set it to Default Access.
If you want extra paranoia
Restricted Access blocks the requests Claude makes, and they come from Anthropic’s servers (160.79.104.0/21), not from wordpressforcowork.com or your computer. If you must keep Restricted Access, allow that range and the /wp-json/coworkmcp/* path.
What about “Disable XML-RPC”?
Leave it on if you’ve turned it on. Claude’s requests don’t go through XML-RPC, so disabling XML-RPC has no effect on the WordPress for Cowork plugin.
If the connection still fails
Check the Solid Security dashboard for blocked events on the /wp-json/coworkmcp/* path. Allow them from there.