The “Filter Suspicious Query Strings in the URL” option is what was blocking the plug-in. Enabling iThemes with that option disabled in the Security section fixed the issue.
There is even a warning that the option can block certain plug-ins.
Thank you Benjamin!