--- title: Patchstack Protection troubleshooting description: "Most Patchstack Protection issues come down to a handful of causes, and by far the most common is Patchstack being unable to reach your website when you add it. Work through the section that matches what you are seeing. ##…" url: "https://www.aeserver.com/support/patchstack-troubleshooting/" updated: "2026-10-12" category: Security / Patchstack --- # Patchstack Protection troubleshooting Most Patchstack Protection issues come down to a handful of causes, and by far the most common is Patchstack being unable to reach your website when you add it. Work through the section that matches what you are seeing. ## "The site cannot be added" or the connection fails This is the most common issue we see, and it almost always means the same thing: **Patchstack could not reach your website**. To add a site, Patchstack has to connect to it from its own servers. If that request is blocked or returns an error, the site cannot be added. Before working through the checks below, open **Protected Site** in your client area. If **Last sync** is recent, the connection is fine and your problem lies elsewhere. If it is stale or the plugin shows as not installed, the checks below apply. ![Protected Site panel showing domain, protection state, firewall status, plugin version and last sync time](https://www.aeserver.com/wp-content/uploads/2026/08/patchstack-protection-status.jpg) Check Last sync first. A recent timestamp means the site is reaching Patchstack. ### Check 1: is the site returning an error to visitors it does not recognise? This catches people out because the site often looks completely fine in your own browser. Your browser may be whitelisted, cached, or simply not subject to the rule that is blocking Patchstack. Meanwhile the server returns an error (for example a **5xx** error) or blocks the incoming request from Patchstack entirely. Patchstack needs the site to return a normal **200** status. Ask your host, or check your server logs, for the response code returned to external requests. A site that loads perfectly for you can still be refusing everyone else. ### Check 2: are you blocking traffic with Cloudflare or a similar service? Country blocking is the usual culprit. If you have set Cloudflare to allow visitors only from the UAE, for example, requests from Patchstack's servers elsewhere will be refused before they ever reach your site. Bot-fighting rules, "under attack" mode, and rate limiting can all have the same effect. ### Check 3: allowlist the Patchstack IP addresses The reliable fix is to allow Patchstack's IP addresses through your firewall, security plugin, hosting-level firewall, and Cloudflare rules. Patchstack publishes the current lists at two endpoints: - [patchstack.com/ips-v4/](https://patchstack.com/ips-v4/) for IPv4 addresses - [patchstack.com/ips-v6/](https://patchstack.com/ips-v6/) for IPv6 addresses **Important**Patchstack may add or remove IP addresses at any time without notice, so check the endpoints above rather than copying a list into a permanent rule. If you use Cloudflare, Patchstack also publishes [specific Cloudflare configuration guidance](https://docs.patchstack.com/faq-troubleshooting/technical/how-to-configure-patchstack-to-work-with-cloudflare/). ### Check 4: the basics - Is the site online and out of maintenance mode? A site in maintenance mode returns an error to Patchstack. - Is the URL exactly right, including https and any www prefix? - Is the site reachable from the public internet? Intranet and local development sites cannot be added in the normal way. - Is the site password protected, for example with .htpasswd? Patchstack needs to reach it without a password. **Tip**Still stuck? Contact AEserver support with the exact error message shown. The message tells us whether Patchstack got an error code, was blocked, or timed out, which points straight at the cause. ## The connection was lost after a site change If your site suddenly appears disconnected in the Patchstack app, a common cause is that your **WordPress security keys and salts were regenerated**. This happens more often than people expect: some security plugins rotate salts as a "harden" action, some hosts rotate them during a migration, and some people change them deliberately after a suspected compromise. Changing the salts breaks the plugin's stored connection to Patchstack, and the plugin shows an error when this happens. To fix it, contact our support team and we will reconnect the site for you. If you manage the plugin yourself, re-enter the API key in WordPress under **Settings > Security** (Change API key), then click **Sync**. ## My site shows as unprotected after installing the plugin If your site is hosted with AEserver, contact support and we will check it. For sites hosted elsewhere, this usually means the API key was never applied. Open the Patchstack plugin settings and confirm the key from your client area is pasted correctly, with no leading or trailing spaces. Each license covers one website, so check you are using the key issued for that specific domain rather than one from another site. ## My dashboard shows no data yet After activation it can take a few minutes for data to appear. If it has been longer than an hour, confirm the plugin is active, the API key is applied, and the correct domain is linked in your client area, then refresh the dashboard. ## Will it conflict with my other security plugins? Patchstack Protection is designed to run alongside other tools. Avoid enabling duplicate features though, for example two firewalls, which can cause problems on some sites. If you run another security plugin, switch off its overlapping feature rather than removing the plugin entirely. **Important**If another security plugin blocks or rate-limits unrecognised traffic, it can also stop Patchstack from reaching your site. Allowlist the Patchstack IP addresses in that plugin too. ## My site feels slow after enabling it It should not be. Mitigation rules are deployed only on demand and target only the software you actually run, rather than filtering every request against a generic rule set. Figures Patchstack publishes show sub-millisecond overhead per request and memory use of under a kilobyte on current PHP versions. If you notice a slowdown, it is almost always unrelated; contact support and we will help you pinpoint it. ## A legitimate action is being blocked False positives are rare because rules are targeted rather than generic. If a legitimate request is blocked, note the exact action you were taking and any error shown, then contact support so we can investigate and adjust the rules for your site. ## I think my site is already hacked **Important**Patchstack Protection prevents hacks but does not clean up an existing infection. If you suspect your site is already compromised, [contact AEserver support](https://www.aeserver.com/contact-us/) right away. We will guide you through clean-up options, then enable protection to keep it secure going forward. ## Still need help? ### Our UAE-based support team is available 24/7 - Open a ticket from your client area - Start a live chat on aeserver.com When reporting a connection problem, include the exact error message and the site URL. That alone usually identifies the cause. **Get Patchstack Protection**Reading this before buying? [See pricing and get started](https://www.aeserver.com/patchstack-wordpress-security/).