Site won't connect because of my security plugin - had to deactivate it

Great catch - this is one of the most common connection blockers, and you do NOT have to leave your security plugin off. Security plugins often disable the WordPress REST API or block Application Password / Basic Auth logins by default. Instead of deactivating the whole plugin, just allow these specifically:

1) Re-enable the REST API. In the plugin settings, look for an option like 'Disable REST API' or 'Restrict REST API to logged-in users' and turn it OFF (or allow authenticated requests).

2) Allow Application Passwords / Basic Auth. Some plugins block the Authorization header. Look for 'Disable Application Passwords', 'Block Basic Auth', or an XML-RPC/Auth-header setting and make sure Application Passwords are allowed.

3) Whitelist our requests. If the plugin has a firewall, you can allow the connector's User-Agent or the /wp-json/ path.

Plugin-specific quick notes:
- Wordfence: Firewall usually does not block this, but check 'Login Security' and any REST API rules. Application Passwords should stay enabled.
- iThemes / Solid Security: turn off 'Disable REST API' and make sure 'Filter Suspicious Query Strings' isn't stripping the auth header.
- All In One WP Security: check the 'Firewall' and 'Brute Force' sections for REST API / auth blocking.

Do that and you can reconnect with the plugin fully active. Turning the plugin off should only ever be a quick test to confirm it's the cause - re-enable it right after.

That did it. I turned the 'Disable REST API' option off and allowed Application Passwords, reconnected with the security plugin still active, and it works. Thanks - leaving security on feels much better.