CUNY Academic Commons

Via Keeping, Gail Hayes from Kingsborough reports:

Hi...I recently contacted Jetpack to inquire about the stats that no longer grant full access for my site on CUNY Commons. I had full access, but it is now limited. I read that once the site reaches a certain number of views, you may have to request a re-eval. In any event, the response is below.

Thank you.

Gail Hayes

From: Jetpack Support <support@jetpack.com>
Sent: Saturday, 17 January 2026 2:51 PM
To: Gail Hayes <ghayes@kbcc.cuny.edu>
Subject: [Jetpack] [Stats] Re-evaluate of non-commericial site

• External Sender - Proceed Cautiously with Links and Attachments. *

Willow (Jetpack)

Jan 17, 2026, 19:51 UTC

Hi there -

Thanks for reaching out about your use of Jetpack Stats on your site https://psyc.commons.gc.cuny.edu.

At present, Jetpack Stats is not free for university sites. We have more information on this here:

https://jetpack.com/support/jetpack-stats/free-or-paid/#non-profits-and-jetpack-stats

To obtain full access to Jetpack Stats, you will want to purchase commercial license:

https://cloud.jetpack.com/pricing#jetpack_stats_yearly

Additionally, while working on this ticket, I saw that something on your web server is blocking the communication channel between your site and Jetpack's servers.

We're seeing a block when we try to communicate via
xmlrpc.php:

Testing: https://psyc.commons.gc.cuny.edu//xmlrpc.php

HTTP/2 403
date: Sat, 17 Jan 2026 19:48:02 GMT
content-type: text/html; charset=UTF-8
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cf-mitigated: challenge
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server-timing: chlray;desc="9bf85e2cbce3f608"
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
strict-transport-security: max-age=15552000
server: cloudflare
cf-ray: 9bf85e2cbce3f608-ORD
alt-svc: h3=":443"; ma=86400

I’d  suggest  checking if  you  have  any  security  plugins  activated that  might  be  blocking  our requests.  If  not,  try  contacting  your  hosting  provider  and  asking  them  to  check  their  security  logs  to  see  if  they  are  blocking  or  otherwise  limiting  incoming  and  outgoing  connections  over  XML-RPC. 

Jetpack  uses  this  file  to  communicate  with  your  site,  but  some  hosts  block  connection  requests  to  that  file.

Our  requests  look  like  the  following:

 File:   https://psyc.commons.gc.cuny.edu/xmlrpc.php
-  User-agent header:  Jetpack  by  WordPress.com
-  IPs:  https://jetpack.com/support/how-to-add-jetpack-ips-allowlist/

Please  ask  them  to  allowlist  the  IP  addresses  listed  above.  Note  that  these  IP  addresses  could  change  (or  more  could  be  added)  at  any  time,  which  could  break  your  connection  to  Jetpack.  For  this  reason,  we  actually  discourage  allowing  specific  IPs,  although  with  some  hosts  it  may  be  the  only  option.

Let  us  know  how  that  goes.
Best,

Willow

Happiness Engineer: Jetpack | Akismet | WPScan

This is part of request 10735671.