Skip to main content

Get Support
Have a question? Let's get you an answer!

How Do I...? Troubleshooting Code & Webhooks Developer Zone

Other Help Resources
Wait, there's more! Check out these Community sourced spaces for additional resources.

Zapier Help Center Hire an Expert

Learning Resources
All of our best learning resources can be found here.

Featured Articles Show & Tell Zapier's products AI Hub Zapier Tools Hub

Share your knowledge
Give back to the Community by sharing your automation wins and helping to answer questions.

Share your success See unanswered questions User Groups

Other Learning Resources
Some of our favorite additional ways to upskill your Zapier knowledge.

Zapier Learn Zapier Blog Zapier Webinars

Product Updates
Check out what is new and upcoming with Zapier with our regular product updates.

Product Updates

Early Access Program
Want to join Early Access? Learn more here.

I'm currently integrating Zapier with several WordPress sites and facing a bit of a challenge. We've noticed that when WordFence or our hosting's firewall is active, it blocks Zapier's connections, preventing our Zaps from functioning correctly. Temporarily disabling these security measures confirms that they're the cause, as the Zaps then run without issue.

I understand that Zapier utilizes AWS (Amazon Web Services) for its operations, and it's suggested that adding AWS IP addresses to the allowlist in WordFence and our firewall could solve our problem. However, navigating AWS to find the right IPs seems a bit daunting given my current expertise level.

I'm reaching out to see if anyone here has experience with this and can guide me on how to identify and list the appropriate IP addresses. Specifically, I'm looking for a simplified way to retrieve these IPs to allowlist them, ensuring seamless connectivity between Zapier and our WordPress sites without compromising security.

Any advice, tools, or resources that could make this process easier would be immensely appreciated. Thank you in advance for your assistance and insights!

Hi ​@di5gu5tipated,

 

Zapier's IP addresses fall within the AWS us-east-1 range but are not exclusive to Zapier. The team is working on a solution while there isn't a dedicated IP range yet. For strict allowlisting, using a dedicated server or a service with a static IP may help.

 

We appreciate your understanding and patience as we work on improving this aspect of our service. If you have any further questions or concerns, please don't hesitate to let us know.

Hi there @Nue. Welcome to the Community! 🙂

The IPs addresses used could be any of the ones listed in the us-east-1 range, there isn’t a smaller set of IP addresses that would be used specifically when running WordPress triggers and actions. That said, rather than adding each individual IP address in that range to the allowlist, there’s a couple alternatives you could try:

  • Translate the IPs into a range - if WordFence supports CIDR notation then you can use that to specify a range for a block of multiple IP addresses. See here for details on how to calculate the range: Translate IPs into ranges
  • Allow the User-Agent - All requests from Zapier will include the same header “User-Agent: Zapier” so you could potentially allow all requests that contain that same user agent.

 

Can you give the above suggestions a try and let me know if that works any better?

Are the IPs youre linking to dedicated to zapier services? if not its still quite a large security risk to open to all firewall rules to AWS IPs as its very easy for threat actors to rent a VPS and run some scripts to launch an attack. A user agent is also very easy to spoof so that is not a reliable means to filter web requests on. Can you confirm the IPs you linked to are dedicated to Zapier? if not do you have another solution?

Hi there @Nue. Welcome to the Community! 🙂

The IPs addresses used could be any of the ones listed in the us-east-1 range, there isn’t a smaller set of IP addresses that would be used specifically when running WordPress triggers and actions. That said, rather than adding each individual IP address in that range to the allowlist, there’s a couple alternatives you could try:

  • Translate the IPs into a range - if WordFence supports CIDR notation then you can use that to specify a range for a block of multiple IP addresses. See here for details on how to calculate the range: Translate IPs into ranges
  • Allow the User-Agent - All requests from Zapier will include the same header “User-Agent: Zapier” so you could potentially allow all requests that contain that same user agent.

 

Can you give the above suggestions a try and let me know if that works any better?

Terms & Conditions