How to allow OrderKrab through a WordPress firewall or security plugin

The most common reason WooCommerce refuses OrderKrab's API key is not the key itself but something in front of WordPress: a security plugin, a firewall, a CDN or the host's own protection blocks OrderKrab's requests to the WooCommerce REST API, or changes them so that WooCommerce treats them as anonymous. This guide finds the blocker and lets OrderKrab through. After each change, open Shipping → Checkout in OrderKrab and click Refresh - the warning disappears as soon as one request gets through.

1. 1

   First check whether OrderKrab's requests reach WooCommerce at all. In your WordPress admin open WooCommerce → Settings → Advanced → REST API and note the Last access time of the OrderKrab Integration key. Click Refresh in OrderKrab, then reload the key list. If Last access has updated, the request arrived and the key was accepted, so the problem is the key's permissions: edit the key and set Permissions to Read/Write. If Last access does not change, something blocks or alters the request before WooCommerce sees it - continue below.

2. 2

   Open your security plugin's firewall log and look for blocked requests to /wp-json/wc/v3/ around the time you clicked Refresh, then allow them. In Wordfence, open Tools → Live Traffic, filter by Blocked to find the request, and allow it under Firewall → All Firewall Options (add OrderKrab's address to Allowlisted IP addresses, or the request to Allowlisted URLs). In WP Cerber, open Hardening and add wc to the REST API namespaces that are allowed. In Solid Security, open Settings → WordPress Tweaks and set REST API to Default Access. In All-In-One Security, turn off Disallow unauthorized REST requests. A plugin whose job is to disable the REST API must either allow the wc/v3 namespace or be deactivated.

3. 3

   If your site is behind Cloudflare, open SSL/TLS and make sure the encryption mode is Full or Full (strict), never Flexible: with Flexible, Cloudflare talks to your server over plain HTTP, WordPress doesn't see HTTPS, and WooCommerce ignores API keys on requests it believes are insecure. Then open Security → WAF → Custom rules and add a rule for requests whose URI Path starts with /wp-json/wc/v3/ with the action Skip (skip the managed rules, rate limiting and bot protection it offers). If Bot Fight Mode is on and the rule can't exempt it, turn Bot Fight Mode off. Other CDNs and web application firewalls (Sucuri, BunnyCDN, Imperva and the like) have an equivalent allowlist for a path.

4. 4

   Many hosts run their own firewall (often ModSecurity) in front of every site. Look in your hosting control panel for a Security, Firewall or WAF section and allow requests to /wp-json/wc/v3/, or ask the host's support to allow the WooCommerce REST API for your site - mention the path and that the requests come from OrderKrab. The host's error log names the rule that blocked the request.

5. 5

   If HTTPS is terminated by a load balancer or reverse proxy in front of WordPress, tell WordPress about it. Add this to wp-config.php above the line That's all, stop editing!:

   if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && 'https' === $_SERVER['HTTP_X_FORWARDED_PROTO'] ) {
       $_SERVER['HTTPS'] = 'on';
   }

   Without it, WooCommerce treats every API request as insecure and drops the key.

6. 6

   If your server runs PHP as CGI or FastCGI under Apache, it may drop the Authorization header that carries the key. Add this at the top of .htaccess, above the # BEGIN WordPress block:

   RewriteEngine On
   RewriteCond %{HTTP:Authorization} ^(.*)
   RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]

   Your host can do this for you if you don't edit server files yourself.

7. 7

   Back in OrderKrab, open Shipping → Checkout and click Refresh. The warning disappears as soon as your store answers, and your WooCommerce zones and rates are listed again.