A blocked WordPress Ajax request is usually fixed by identifying which layer rejected it: your JavaScript, the WordPress handler, a nonce or capability check, a security plugin, a CDN/WAF, or the web server. Open the browser Network panel first, record the request’s status code and response body, then correct that layer. Do not begin by disabling the firewall or the REST API.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Start with the Network panel, not the console
A message such as “Ajax request failed” in the console does not say where the request stopped. The browser may have received a WordPress response, a security-plugin page, a CDN challenge, or an upstream error. The Network panel shows the distinction.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Open Developer Tools in the browser and select Network.
- Filter for
admin-ajax.php,wp-json,XHR, orfetch. - Repeat the action that fails.
- Open the request and record its full URL, method, status, initiator, request payload or form data, response headers, and response body.
- Check whether a request was sent at all. A JavaScript exception, blocked mixed-content request, or failed preflight can stop it before WordPress receives anything.
Save the response body before changing settings. A WordPress JSON error, a -1 or 0 response, an HTML firewall page, and a PHP fatal-error message point to different fixes.
What common status codes mean
| Status or response | Likely layer | First check |
|---|---|---|
| 401 | Authentication or an upstream access rule | Login cookie, API credentials, and the request’s user context |
| 403 | Nonce failure, capability denial, security plugin, WAF, or server rule | Response body, nonce field, user capability, and firewall events |
| 404 | Wrong path, rewrite problem, or missing REST route | Exact URL and whether the route is registered |
| 500 | PHP fatal error, plugin conflict, or server failure | WordPress and PHP logs; the response may contain a useful error in a development environment |
200 with 0, an empty body, or unexpected HTML |
Unmatched Ajax action, output contamination, or an intermediary response | action value, registered hooks, and the raw response |
| Timeout or stalled request | Slow PHP, database work, upstream limits, or an overloaded admin-ajax.php |
Server timing, PHP workers, database logs, and the request’s operation |
A status code alone is not proof of the blocking layer. A 403 can be produced by WordPress itself or by a WAF that never passes the request to WordPress. Match it with the response body and the timestamp in each relevant log.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Make sure the request reaches the correct Ajax endpoint
WordPress Ajax requests are sent to /wp-admin/admin-ajax.php. The correct absolute URL depends on the site’s domain, installation directory, HTTPS setting, and sometimes multisite configuration. Frontend code should receive that URL from PHP rather than guessing it or hardcoding a production domain.
Pass the endpoint from PHP
Enqueue the script and expose the endpoint and nonce as data. wp_localize_script() is commonly used for a small data object; an equivalent inline or data-attribute approach is also fine.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors<?php
wp_enqueue_script(
'site-ajax',
get_template_directory_uri() . '/assets/site-ajax.js',
array(),
'1.0.0',
true
);
wp_localize_script('site-ajax', 'siteAjax', array(
'url' => admin_url('admin-ajax.php'),
'nonce' => wp_create_nonce('save_profile'),
));The endpoint value must be the same site and protocol that served the page. A hardcoded http:// URL on an HTTPS page can be blocked as mixed content; a domain copied from a staging site can send the request to the wrong installation.
Send an action and inspect the raw response
const data = new URLSearchParams({
action: 'save_profile',
_ajax_nonce: siteAjax.nonce,
display_name: document.querySelector('#display-name').value
});
fetch(siteAjax.url, {
method: 'POST',
credentials: 'same-origin',
headers: {'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8'},
body: data
})
.then(async response => {
const body = await response.text();
console.log(response.status, body);
if (!response.ok) throw new Error(`HTTP ${response.status}`);
return body;
});For jQuery, the same information belongs in the url and data options. Do not assume jQuery can discover the correct WordPress URL by itself.
Register the matching server-side hooks
The value sent in action must match the suffix of a registered hook. Logged-in users use wp_ajax_{action}. If visitors who are not logged in are supported, register the separate wp_ajax_nopriv_{action} hook as well.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
add_action('wp_ajax_save_profile', 'my_save_profile');
add_action('wp_ajax_nopriv_save_profile', 'my_save_profile'); // only if public use is intended
function my_save_profile() {
check_ajax_referer('save_profile');
if (!is_user_logged_in() || !current_user_can('edit_profile')) {
wp_send_json_error(array('message' => 'Not allowed'), 403);
}
$name = isset($_POST['display_name'])
? sanitize_text_field(wp_unslash($_POST['display_name']))
: '';
wp_send_json_success(array('display_name' => $name));
}If no callback matches the action, WordPress commonly returns an empty or zero-style response instead of the JSON your JavaScript expects. Inspect that response before changing security settings. Also check that the plugin or theme containing the hook is active and loads before the request is made.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRepair nonce and authorization failures
A nonce proves that a request was generated in an expected WordPress session and context; it is not a permission system. A valid nonce does not grant access to another user’s data or an administrative operation. Verify the nonce and then enforce capabilities separately.
Admin Ajax nonce checklist
- Create the nonce for the same action string that the handler verifies.
- Send it in the field name the handler expects.
_ajax_nonceis common, but custom field names are possible. - Call
check_ajax_referer()with the matching action. A failed check normally ends the request with HTTP 403. - Ensure the page was not cached with an old nonce. Cached HTML, long-lived browser tabs, and full-page optimization can leave a stale value in the JavaScript object.
- Use
current_user_can()for the operation’s real authorization requirement. - Validate, sanitize, and type-check every incoming value. Never treat a nonce as validation.
When a nonce suddenly fails after a deploy, clear or bypass the page cache and regenerate the page. If only logged-out visitors fail, confirm that the public hook is registered and that your design intentionally permits anonymous use.
REST API authentication
REST requests generally carry a nonce in the _wpnonce parameter or the X-WP-Nonce header when using the logged-in WordPress cookie session.
fetch('/wp-json/example/v1/profile', {
method: 'POST',
credentials: 'same-origin',
headers: {
'Content-Type': 'application/json',
'X-WP-Nonce': window.wpApiSettings.nonce
},
body: JSON.stringify({display_name: 'New name'})
});Check that the route is registered for the HTTP method being used, its permission callback allows the current user, and the browser sends the login cookie. A 401 or 403 can result from missing cookies, an expired nonce, or a permission callback—not necessarily from a firewall.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Find and correct security-plugin or WAF blocks
Security controls can reject the endpoint itself or a particular parameter before the PHP callback runs. Common layers include a WordPress security plugin, a CDN WAF, a hosting firewall, ModSecurity, fail2ban, and custom .htaccess or NGINX rules.
Use logs to prove which layer blocked the request
- Copy the request timestamp, client IP as shown to the relevant service, method, path, and suspicious parameter from the Network panel.
- Check the security plugin’s live traffic or firewall events for that timestamp.
- Check the CDN or host WAF event log, then the web-server access and error logs.
- Compare the response body. A branded challenge or block page usually came from an intermediary; a WordPress JSON error means the request reached PHP.
- Repeat with one variable changed, such as the parameter value, to determine whether the rule targets the endpoint or the payload.
Wordfence-style firewall workflow
When its firewall blocks a legitimate Ajax action, the documented workflow is to switch the firewall to Learning Mode, perform the blocked action once, then return it to Enabled and Protecting. Its Live Traffic view can also be used to identify the specific request and add the needed parameter to an allowlist. Use this only while reproducing the known action, and verify that protection is restored immediately afterward.
Do not globally allow every request to admin-ajax.php. That endpoint is shared by core, themes, and plugins, so a broad exception can remove an important security boundary.
Prefer a narrow exception
| Exception scope | Use when | Risk and control |
|---|---|---|
| One action and parameter | A rule falsely flags a known field value | Smallest scope; keep request logging enabled |
| One path and HTTP method | A trusted Ajax operation is blocked by method filtering | Confirm the callback and authentication before allowing it |
| One authenticated role or IP range | An internal maintenance action needs access | Recheck role and IP changes; do not use as a substitute for capabilities |
Whole /wp-admin/ or all Ajax |
Almost never justified | Creates a broad bypass and can expose unrelated handlers |
After adding an exception, retest the original request and a deliberately invalid version. The invalid request should still be rejected, demonstrating that the rule was narrowed rather than disabled.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Cloud WAF, host firewall, and server-rule checks
If the WordPress logs contain no trace of the request, it may have stopped at the CDN, host firewall, or web server. Review the event details for the exact path, method, query string, body parameter, country or IP rule, rate limit, bot score, and challenge action. A rule that blocks a parameter name can affect only one Ajax feature while leaving the endpoint itself reachable.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- Cloud WAF: allow the required path and method or tune the specific managed rule; retain logging and rate limiting.
- ModSecurity: identify the rule ID in the audit log and create a targeted exclusion for the legitimate parameter rather than disabling the engine.
- NGINX or Apache: inspect location blocks, rewrite rules, request-method restrictions, and deny directives affecting
wp-admin/admin-ajax.php. - fail2ban or IP controls: confirm that repeated development requests did not ban the tester’s address.
Do not create a blanket “allow all /wp-admin/” rule. Limit the exception by path, method, authenticated context, or parameter, and document how to remove it.
Keep the REST API enabled and fix the underlying failure
Disabling the REST API is not a safe general workaround. WordPress Admin functionality depends on an active REST API, so turning it off can break editing screens, media interfaces, widgets, and other administrative operations.
If a REST request fails, repair the actual cause:
- Restore the correct
_wpnonceorX-WP-Nonce. - Ensure the login cookie is sent and the request uses the expected origin.
- Confirm the route and HTTP method are registered.
- Fix the route’s permission callback and input validation.
- Remove the WAF or server rule that is blocking the route.
CORS and cross-origin requests
A REST call made from a different origin can fail before WordPress sees the real request. The browser may send an OPTIONS preflight and require the server to return appropriate CORS headers for the requesting origin, method, and headers. If cookies are involved, the server and browser must be configured for credentialed requests; a wildcard origin is not a valid substitute for an explicit trusted origin in that case.
First determine whether the frontend and WordPress are actually different origins (scheme, host, or port). If they are, inspect the preflight in Network and configure CORS at the layer that owns the API response. Do not weaken authentication merely to silence a CORS error.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Handle 500 errors, malformed output, and timeouts
500 responses
A 500 response usually indicates a PHP or plugin failure rather than a nonce problem. Check the PHP error log and WordPress debug log at the matching timestamp. Temporarily deactivate or isolate the plugin that registers the Ajax action, switch to a default theme in a staging environment, and reproduce the request. Fix the fatal error, type mismatch, missing function, or database failure before re-enabling production traffic.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Unexpected HTML or invalid JSON
Ajax handlers that promise JSON must not print notices, warnings, template markup, debugging text, or a login page before the JSON response. Inspect the raw body, enable logging without displaying errors to visitors, and remove accidental output. Use wp_send_json_success() or wp_send_json_error() so the handler terminates with a consistent response.
Timeouts
A timeout can be caused by slow database queries, remote HTTP calls, image processing, exhausted PHP workers, or a WAF waiting on an upstream response. Measure server-side execution time, inspect slow-query and PHP-FPM logs, and test a minimal handler. Do not simply increase the browser timeout: that hides the symptom while tying up more workers.
Temporarily bypass caching and optimization
After endpoint, hook, nonce, and firewall checks pass, temporarily bypass page caching, JavaScript concatenation, minification, defer settings, and script-optimization plugins. These can reorder execution, serve an old localized nonce, or alter the request body. Test with a fresh private window, then re-enable one optimization at a time until the interfering setting is identified. Purge both the page cache and CDN cache when a stale script or HTML document is suspected.
Retest every supported user context
- Test while logged in as the role that should be allowed.
- Test while logged in as a role that should be denied.
- Test logged out if a public
wp_ajax_nopriv_*handler is intentional. - Repeat with valid, missing, expired, and deliberately altered nonces.
- Test the expected payload and an invalid or oversized value.
- Run the request with caches and optimization bypassed, then with each production layer restored.
A successful response for one account does not prove that authorization is correct for every account. Record the final status, response shape, and relevant log entry so a future rule change can be compared with a known-good request.
Choose the fix by layer and reversibility
| Observed evidence | Corrective action | Do not do |
|---|---|---|
| No request in Network | Fix JavaScript execution, mixed content, URL construction, or preflight | Change WordPress firewall settings |
| 404 or wrong host | Pass admin_url('admin-ajax.php') from PHP or correct the REST route |
Allow the wrong path through a WAF |
| 403 with nonce-related body | Send the expected nonce field, match the action, refresh stale HTML, then check capabilities | Remove nonce verification |
| 403 with firewall event and no WordPress log | Create a logged, narrow exception for the legitimate action | Disable the firewall or allow all admin paths |
| 500 or PHP log entry | Fix the callback, dependency, data handling, or database operation | Mask the error with a larger timeout |
| REST Admin features fail after a security change | Restore REST access and repair authentication or the blocking rule | Disable REST globally |
Production hardening checklist
- Generate the Ajax URL in PHP and expose it to the script; never rely on a hardcoded domain.
- Register only the logged-in and public hooks your feature actually needs.
- Verify a nonce in the field name your client sends.
- Enforce capabilities independently of nonce verification.
- Validate and sanitize every request value.
- Return consistent JSON and prevent notices or debug output from contaminating it.
- Keep REST enabled and protect routes with proper permission callbacks.
- Log firewall decisions and use the narrowest reversible exception.
- Retest logged-in, logged-out, allowed, and denied contexts after every security or caching change.
The reliable fix is the smallest one that matches the evidence: correct the URL or hook when WordPress never received the intended action, refresh and verify the nonce when authentication data is stale, repair capabilities when authorization is wrong, and tune only the precise security rule that blocked a legitimate request. Leave the firewall and REST protections enabled once the request works.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
