Some hosts, security plugins, and Cloudflare settings block requests that do not come from a real browser. That protects the site, but it also blocks Formitor from checking in.
When that happened, your dashboard showed the plugin as inactive even though it was installed and working normally.
How it works now
The Formitor plugin reports out to us on its own, roughly every five minutes, rather than waiting for us to contact it. Outgoing requests from your server are not affected by the rules that block incoming ones, so protected sites report in normally.
You do not need to do anything. There are no firewall rules to write, no allowlists to manage, and no IP addresses to add. It works out of the box on version 0.2.27 and later.
What you get on a protected site
- Accurate plugin status instead of a false "inactive" badge.
- The current plugin version, so you can see when a site needs updating.
- An up to date list of forms and the notification recipients set on each one.
- Full delivery testing, with the same verdicts and alerts as a directly reachable site (version 0.2.29 and later).
- Daily lead counts, so lead volume anomaly alerts cover protected sites as well.
Does it slow my site down?
No. The report is sent after your visitor's page has already finished loading, and it is sent without waiting for a reply. Visitors never wait on it.
Delivery tests on protected sites
Delivery tests run on protected sites too, from plugin version 0.2.29 onward. Instead of sending the test from outside, Formitor queues it and your site runs the whole test locally: it submits the test entry, watches the notification email go out, and reports the result back on its next check-in. The results and alerts on your dashboard look the same as they do for any other site.
Because the test runs locally, it works no matter how strict the firewall is. Test entries are tagged and cleaned up the same way as on any other site, and test emails never reach your real recipients.
Still showing as inactive?
Check that the site is running plugin version 0.2.27 or later. If it is older, update it from your WordPress plugins screen, then allow a few minutes for the first report to arrive.
A notice inside WordPress when a block appears later
Sometimes a firewall is added, or its rules tighten, long after a site was connected. From plugin version 0.2.30, the site notices this on its next check-in and shows a notice in wp-admin to administrators: which service is blocking Formitor, the two IP addresses to allow (185.147.157.155 and 152.53.90.187), and a link to the matching guide. The notice clears itself once the addresses are allowed. Choosing "Remind me in 7 days" hides it for a week; while the block remains, it comes back.
Allowing the addresses is optional. Monitoring keeps working in protected mode either way; the allowlist unlocks instant rechecks and full browser checks.
Allow by User-Agent
Formitor's checks identify themselves with the User-Agent Formitor/1.0 (+https://formitor.com). If your firewall or anti-spam tool supports allow rules by User-Agent, allowing that exact string is the most reliable option: it keeps working even when our server addresses change.
The first check on a firewalled site
Before Formitor tests all of a site's forms it checks one form and confirms that the test email reached only our monitoring inbox. Since plugin version 0.2.64 that first check also runs from the plugin itself when our servers cannot reach the site, so a firewall no longer stops a site from getting started. If the first check cannot submit at all, the site is not paused: the failure appears on that form, and Formitor tries again on the next pass.