0

I host a Wordpress site and wanted to fine-tune my firewall. Therefore I blocked all outgoing NEW connections, except to the wordpress servers for updates.

This works fine - but I noticed, as soon as I publich a post with links in it (with <a> tags) my computer wants to connect to the IPs, where these links are hosted. So in my logs I see failed NEW connections to all IPs, to which I link. Despite blocking these, my post looks fine - I just wonder, why wordpress makes a connection to these sites. Can anybody give me a hint here?

Jus a sidenote: I have disabled the Wordpress Update Service completely.

// Edit 13.01.2022

I assume that the first answer here is right and pingbacks are the cause of my problem. The strange thing is, that connections are opened to every site I link in my blog posts (despite being another blog, a news site or a peer tube site). I further have deactivated (since months)

  • Attempt to notify any blogs linked to from the article
  • Allow link notification from other blogs (pingbacks and trackbacks) on new articles

And it is deactivated under "new posts" in the "discussion" setting of each post. Nevertheless, as soon as I update an old post or post a new one, wordpress obviously tries to connect to every linked ressource in my article - which is very annoying.

I have read an older article about disabling pinging, but in this article it also says:

First, understand that the do_pings entries are added only when Pings are enabled in the WordPress General settings (visit Settings > Discussion > “Attempt to notify any blogs linked to from the article”). So you can disable future occurrences from there.

Understand that disabling this setting means that your site will not ping any linked resources. No big deal really, but be advised.

So I think I should be "good to go" - but I'm not. Can anybody help me here and tell me, why I still get pings?

Thanks and greetings

Matse

Improve this question

2 Answers 2

Reset to default
1

What you're seeing are probably calls from Pingbacks.

If you don't want them you can either disable them globally in the settings or just for a specific post in the "Discussion" metabox in the sidebar of that post.

Improve this answer
4
  • Hello, I have disabled Pingbacks globally (and the option "allow pingbacks and tracebacks" is disabled on my site for new posts). So this should not be the problem.
    – mathse
    Commented Jan 13, 2022 at 9:02
  • Do you have any plugins installed or is it a plain WP install? Can you see the exact URLs being accessed in your firewall logs?
    – kraftner
    Commented Jan 13, 2022 at 16:31
  • Hello, no I have a few plugins installed: Antispam Bee, The SEO Framework, Koko Analytics. In my firewall I just see the IPs (but the URLs resolve to exactly these IPs with "dig", I have tested it with at least 10 links in my blog post).
    – mathse
    Commented Jan 13, 2022 at 17:08
  • 1
    For completeness sake and maybe other people hitting the same issue with a different root cause: When I see e.g. a SEO plugin it might also be possible that a plugin forces Pingbacks or something similar since it might think it is a good idea to always have this on. So try if disabling such plugin changes the behaviour.
    – kraftner
    Commented Jan 14, 2022 at 9:58
0

I have now done the "trick" of this blog post and added the following code:

if (isset($_GET['doing_wp_cron'])) {
    remove_action('do_pings', 'do_all_pings');
    wp_clear_scheduled_hook('do_pings');
}

With this I get no pings and no new outgoing connections in my firewall. Thanks @kraftner for the hint to pings - I really didn't think that this is the cause of my problem (since I deactivated them in the options).

Improve this answer
2
  • First: Glad you solved it. Reading the linked post (without checking!) I assume that these are leftover CRON entries from before you having disabled it. So I'd just try if removing the code after you've now cleaned them up is fine or if they start hitting the firewall again. If they don't come back you can remove the code. Removing lingering use-once code is always a good idea.
    – kraftner
    Commented Jan 14, 2022 at 9:56
  • this is basically what @kraftner answer does, but his is a more robust solution. anyway not sure why you even look at you logs, but that is for a different discussion ;)
    – Mark Kaplun
    Commented Jan 14, 2022 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.