A “blocked” WordPress REST API request can mean several different things: the URL is not routing, the requested endpoint is not registered, credentials are missing or rejected, or the web server is mishandling the request. Capture the exact URL, HTTP method, status code, and response body before changing anything. Do not disable the REST API as a blanket fix: WordPress says that doing so breaks WordPress Admin functionality that depends on it.
What “blocked” means—and what to record first
The REST API is a JSON interface used by the Block Editor and modern plugin interfaces. A failure is not automatically evidence that the whole API is unavailable. A 404, an authentication error, a missing route, and an ignored query parameter point toward different checks.
As an Amazon Associate I earn from qualifying purchases.
Before changing settings, record:
- The complete request URL and HTTP method, such as GET or POST.
- The HTTP status code and full response body. REST API errors commonly return JSON; the response body can explain a status that is otherwise ambiguous.
- Whether the request is intended to be public or requires authentication, and whether it is a read or write operation.
- Whether the issue affects one endpoint or the API root and other routes too.
WordPress explains that API responses use HTTP response codes and JSON error details in its REST API Handbook. A status code by itself does not identify the cause; interpret it alongside the URL, method, response, and access requirements.
Recommended Free Tools
Does the API root load, and is the route present?
First distinguish a routing problem from an endpoint that does not exist. With pretty permalinks enabled, open /wp-json/ on the site. The API root returns an index describing routes and endpoints available on that installation. Check whether the expected namespace—often wp/v2 for core routes—and the specific endpoint appear; plugin routes vary by installation.
If /wp-json/ returns 404
WordPress’s REST API FAQ and key concepts documentation suggest checking pretty permalinks. If they are unavailable, try the query-parameter form /?rest_route=/. The discovery documentation also describes a Link header route variation for sites without pretty permalinks.
If the root works but the endpoint does not appear in its index, investigate whether that route is registered on this site and whether the requested path and method match the route. Do not assume every plugin installs the same routes.
Is the request public, authenticated, and permitted?
Public content is generally available anonymously, while private data and many management actions require authentication. For a rejected request, verify that the endpoint supports the method being sent, that credentials are included and reach WordPress, and that the authenticated user has the capability needed for the action. The REST API reference and API root index help establish available routes and methods.
Check whether the Authorization header reaches WordPress
In some CGI environments, the web server may strip the Authorization header before WordPress receives it. WordPress documents Apache SetEnvIf Authorization and Nginx fastcgi_pass_header Authorization configuration examples in its FAQ. These are server-level changes, not settings to paste blindly into a site. Ask the server administrator or hosting support to confirm the environment and make an appropriate change.
Rank #3
Are query parameters being ignored?
If parameters such as pagination or embedding appear to have no effect, the server may not be passing the query string through correctly. WordPress’s FAQ points Nginx users to the try_files line and shows an example that preserves query arguments with $is_args$args. This is a possible Nginx cause, not a universal fix for every server, proxy, or API failure. Have the administrator or host review the configuration before editing a live server.
Choose the next check by symptom and configuration owner
| Observed symptom | Next check | Likely configuration owner |
|---|---|---|
/wp-json/ returns 404 |
Check pretty permalinks; try /?rest_route=/. |
WordPress administrator, with server or host support if routing remains broken |
| API root responds, expected endpoint is absent | Inspect the root index and verify that the namespace, endpoint, and method are registered. | Plugin or site developer |
| Authenticated or write request is rejected | Check credentials, method support, user capability, and whether the Authorization header reaches WordPress. | WordPress administrator; server administrator if headers are stripped |
| Query parameters have no effect | Check whether the server preserves the query string; Nginx users can ask an administrator to inspect try_files. |
Server administrator or hosting support |
Keep the REST API enabled while managing access
WordPress’s FAQ states: “You should not disable the REST API; doing so will break WordPress Admin functionality that depends on the API being active.” If you have a specific access-control requirement, the FAQ documents the rest_authentication_errors filter as a way to require authentication. Apply restrictions deliberately and test the editor and plugin behavior for the users who need them; broad blocking can disrupt normal site functionality.
Security should come from appropriate authentication and permissions, not from weakening protections to make a request pass. WordPress’s security guidance recommends validating and sanitizing input, escaping output, and keeping code current.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11When the cause is still unclear
If these checks do not resolve the issue, give the site administrator or host the request URL and method, status and response body, whether it was authenticated, and which diagnostic checks you tried. Those details help distinguish WordPress route or permission issues from web-server handling without making broad, potentially disruptive changes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
