Managed Plugin Updates: Issues which may prevent updates from running

Managed Plugin Updates is generally able to update any plugin on your site. However, there are a few situations where MPU may be prevented from completing updates. Read below to understand common issues and how to solve them.

---

Table of Contents:

1. Blocked by firewall
2. Site requires a login
3. Caching services
4. CleanTalk plugin

---

Blocked by firewall

If requests to update your website from Managed Plugin Updates are denied by a WAF (web application firewall), you may need to modify the WAF’s allowed list to ensure Flywheel’s AI tools can access your site.

Request info

Requests will contain the header named autoupdater and originate from one or more of the following IP addresses:

35.186.183.60
35.221.41.251
35.236.216.128
35.245.159.253
35.245.210.234
35.245.251.214
35.245.50.252

Allowing access to Wordfence’s WAF

1. From your WP Admin area, go to Wordfence > Firewall and click All Firewall Options.
2. Next, expand Advanced Firewall Options and enter the MPU IP addresses into the “Allowlisted IP addresses that bypass all rules”.
3. Save your changes and you’re done!

Allowing access to Cloudflare’s WAF

If you are using Cloudflare’s WAF, you can allow access by adding a rule via one of the following methods:

By header name:

any(http.request.headers.names[*] == "autoupdater")

By URI:

any(http.request.uri.args["autoupdater"][*] == "api")

or

any(http.request.uri.args.names[*] == "autoupdater_nonce")

Learn more about Cloudflare WAF rules here.

Configuring IP Access Rules for Cloudflare

To create an IP Access Rule, follow these steps:

1. Log in to your Cloudflare account.
2. Select your domain.
3. Click the Firewall app.
4. Click on the Tools tab.
5. Under IP Access Rules, enter the following details:
6. Enter the Value as an IP, IP range, or two-letter country code.
7. Select an Action.
8. Select whether the rule applies to This website or All websites in the account.
9. (Optional) add a Note (i.e. Payment Gateway).
10. Click Add.

---

Site requires a login

If your site requires a login (such as internal pages like an Intranet), our software won’t be able to complete updates for your site. Our visual regression tool requires access to the front-end of the site and having a login will cause this to fail.

In these circumstances, we recommend unenrolling the site from Managed Plugin Updates in the Flywheel app.

---

Caching Services

To ensure maintenance mode can enable and disable correctly, Managed Plugin Updates should be allowed in any additional caching layers (Sucuri, WP Optimize plugin, NitroPack, Cloudflare, etc).

NitroPack

If your website is utilizing the NitroPack optimization plugin you will need to exclude a cookie to prevent any interruption in our update services.

Cookie name: autoupdater

Cookie value: 1

Learn how to exclude a cookie in NitroPack.

Sucuri

• Set the “Cache Level” option in Sucuri to “Site caching”. Learn more from Sucuri here.
• Add MPU IP addresses to the allowed list under the Whitelist IP Addresses section in the Sucuri dashboard. Learn more from Sucuri here.

Cloudflare

Ensure the MPU IP addresses are whitelisted in Cloudflare. Learn more from Cloudflare here.

---

CleanTalk plugin

The CleanTalk plugin can block Flywheel’s AI tools. To ensure access, please complete the following:

1. Allow Flywheel’s IP addresses in your firewall.
2. Adjust the following settings from the site’s WP Admin area under CleanTalk > Advanced Settings.
   • Turn off the Anti-Crawler feature.
   • Adjust the Anti-Flood count to 20 pages. (Cleantalk assumes Flywheel’s AI tools is a bot because it opens 20 pages in under a minute to take before and after screenshots as part of Visual Regression Testing.)
   • Turn off Check all posts data.

---

Still need help?

If you have questions on this or any of the above please contact our Support team!