Indeed that is not working, but I’m not sure how to get it to work. How can I make the blog user accessible? I couldn’t find info on how to do this in the docs or issues I looked at already unfortunately.
It should work out of the box, without you having to do anything.
The problem is, that I do not see any visible issue, that makes it hard to debug it!
You could check if a different plugin interferes with ActivityPub (maybe try to deactivate some other plugins, starting with caching and security plugins). Let me know if it is a plugin, then I will check why this happens.
It could also be blocked by your webserver, maybe you can ask your hoster?
I have tried with WP_DEBUG on but unfortunately no relevant logs seemed to show up. Will have to experiment with plugins (and maybe themes too?), luckily we don’t have many plugins installed.
OK I have now tried to access https://anticapitalistresistance.org/?author=0 after deactivating all plugins (except ActivityPub) and using the default theme (2025). It still returned a blank page (no data). Any suggestions on how to debug from there?
In case it’s useful, the site is being hosted by WP Engine. I don’t think they would be blocking anything relevant to this, but would be good to know if they’ve been known to work with this plugin or not?
OK I see it now too that it returns an HTTP 403. Maybe that is something to do with WP Engine – will have to investigate it.
WP Engine’s AI support chat produced this text (I don’t know how accurate it is):
The user enumeration block on /?author= routes is a security feature that cannot be turned off. This block is in place to help protect your site from automated bots and potential attackers trying to gather user information.
If you need this route for a specific plugin like ActivityPub, please let me know more about your use case or if you are seeing issues site-wide. I can help you explore safe alternatives or troubleshoot further.
Since I don’t know why ActivityPub plugin needs this route to be accessible, or if there’s an alternative, I’m not sure how to proceed. What do you think?
The plugin needs that route to be accessible to serve actor objects, it’s an integral part of the functionality.
I’d ask them to remove the block for your site. It would probably be enough to allow it for just application/activity+json request. Not sure.
More interaction with the WP Engine chatbot produced:
Yes, you can confirm that anticapitalistresistance.org/?author=0 is blocked (returns a 403 error) due to WP Engine’s platform security settings. This block is a permanent security measure and cannot be changed or removed for individual sites. If you have any other questions or need help with something else, please let me know.
We will look into migrating away from WP Engine, but thought it worth saying this in case you might be able to include a workaround in the plugin, and to help anyone else who runs into the same problem.
