• Installed when my site went live to test and removed it for something better. Years later when monitoring connections to my site I was continually seeing inbound requests from WordPress servers trying to access my site via rest api and xmlrpc endpoints “both of which are disabled”. Further examination and support about these requests, I find out this is Jetpack plugin “which I have never installed”, has registered itself with my site, had generated itself a valid rest token to make connection with my site and it trying to connect using built in rest endpoints cleverly hidden into this plugin and Woocommerce. Even with the plugin removed pretty much right after it was installed, Jetpack was still trying to connect to my instance and gather data years later. Example endpoint it is trying to hit rest_route=/jetpack/v4/connection/data&_for=jetpack There is no mention on their plugin page about this plugin registering itself with Jetpack and what data it is harvesting and at no time did I ever authorize Jetpack to connect to my site. Luckily I had the endpoints it was trying to connect to blocked. The fact that it has been continually trying to connect years down and never unregistered itself when the plugin was uninstalled is a significant security issue.

Viewing 1 replies (of 1 total)
  • Plugin Support Aashik P – a11n

    (@aashik)

    Hi there!

    If we had a link to your site, we’d love to take a look at what happened here, but it is not a hidden fact that WooPayments requires a WordPress.com connection to function, and this connectivity is facilitated through the same process that the Jetpack plugin uses to connect to WordPress.com.

    Without connecting to a WordPress.com account, WooPayments won’t work. If you don’t want Jetpack to ping your site, the best option is to manually disconnect Jetpack connection, which will also mean that WooPayments can’t be used for transactions on the site unless you reconnect.

    Here’s more details on how it works: Connecting to WordPress.com with WooPayments.

Viewing 1 replies (of 1 total)

The topic ‘Data harvesting plugin connecting to Jetpack’ is closed to new replies.