Troubleshoot Jetpack Scan

Did Jetpack Scan stop working? Did you get an email that said Jetpack is having trouble scanning your site? Follow these troubleshooting steps to fix issues with Jetpack Scan.

Jetpack Scan checks these files for security threats:

• All files in the plugins, mu-plugins, themes, and uploads directories.
• Select files from your WordPress root directory, like wp-config.php.
• Other select files inside the wp-content directory.

Once a scan completes, you will receive a notification if any threats are found. These notifications will be in WP Admin, via email, and on your WordPress.com dashboard.

There are a few things that can prevent Jetpack from scanning your site. If you are concerned that Jetpack Scan is not working, please follow the steps below.

Check the Jetpack connection

A working Jetpack connection is required to get Jetpack Scan working properly.

1. Check your site’s connection on the Jetpack Debug page.
2. Troubleshoot the connection using the Fixing Jetpack Connection Issues guide.

Add server credentials

Auto-fixes over HTTP require the Jetpack Protect plugin v4.2 or higher.

If your site’s Jetpack connection is working and Jetpack Scan is still having problems scanning the website, the next step is to add server credentials.

Server credentials are also required to auto-fix any threats if an HTTP-based fix fails or isn’t supported by your setup.

To add server credentials:

1. Follow our Adding Credentials to Jetpack guide.
2. Unsure what server credentials are? Check out our documentation about SSH, SFTP, FTPS, and FTP Credentials.

Check file permissions

1. To help Jetpack scan your site successfully, ensure your SFTP/SSH/FTP credentials have full read and write file permissions to your WordPress installation directory.
2. You can wait for a new scan to run the next day, or trigger a new scan by clicking the Scan Now button on your Scan page.

Review security and firewall settings

Web Application Firewalls (WAF) such as Cloudflare or Sucuri can prevent Jetpack Scan from working, or a security plugin installed on the site may be blocking certain network requests.

1. If you are comfortable, please review and adjust any WAF or security plugin settings to allow all communications between your site and Jetpack. You may need to allowlist Jetpack IP addresses in the plugins’ settings.
2. If not, we recommend temporarily disabling these services/features while troubleshooting Jetpack Scan. Generally, this can be achieved by disabling the plugin, but you might also have to disable a feature in the service provider’s dashboard (i.e.: pausing Cloudflare from their dashboard).

Speak to Your Host

If the above troubleshooting has not worked to get Jetpack Scan running, you may need to speak to your webhost.

1. If you are not sure about who your site is hosted with you can check using WhoIsHostingThis.com.
2. Ask your host to allowlist Jetpack IP addresses.
3. Ask your host to check for any other blocks between them and Jetpack.

If a scan is taking several hours, or if a scan seems to be stuck, that may be something the Jetpack team needs to look into. Please contact us directly and let us know.