PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe message means the Block Editor sent a save request to WordPress’s REST API but received something other than parseable JSON—often a 404 or 500 page, redirect, firewall challenge, login screen, or PHP warning. Your post text is usually not the problem. Find the failed /wp-json/ request, read its HTTP status and response body, then repair the layer that produced it.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What the invalid JSON message actually means
When you click Update or Publish, the Block Editor saves the post through the WordPress REST API. WordPress documentation describes the REST API as the mechanism the editor uses to display and save posts and pages. The editor expects a JSON response confirming the operation. If the server returns an HTML error page, a redirect, a security challenge, a PHP notice, or an empty response instead, the editor reports: “Updating failed. The response is not a valid JSON response.”
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The banner identifies a malformed response, not a single cause. A 404 generally points to routing or rewrite rules; a 403 usually means a firewall or security layer blocked the request; a 500 indicates PHP, plugin, theme, or server failure; and a redirect loop commonly reflects mismatched URL or HTTPS settings. Diagnose the request before changing several settings at once.
Run the three-minute diagnosis first
These checks tell you which layer is failing without making irreversible changes.
-
Check Site Health
Open Tools → Site Health → Status. Look for messages such as “The REST API encountered an error,” “The REST API encountered an unexpected result,” or an HTTPS or loopback warning. Expand the relevant test. Site Health can show the REST endpoint, returned status or error, Home URL, Site URL, HTTPS state, permalink structure, server details, and rewrite or
.htaccessinformation. -
Capture the exact save request
Open your browser’s Developer Tools, select the Network panel, click Update again, and locate the request whose URL contains
/wp-json/or another REST route. Record the full URL, HTTP status, response headers (especiallyContent-Type), and the first lines of the response body. A JSON body means the request reached WordPress; HTML, a redirect page, a CAPTCHA, or a PHP warning identifies the layer that needs attention.What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Open the API directly
While logged out, visit
https://your-domain.example/wp-json/in a new browser window. A working endpoint returns JSON describing the API. A 404 suggests rewrite or web-server routing trouble, a 403 suggests a firewall or security rule, a 500 points to PHP or application failure, and repeated redirects indicate URL or HTTPS configuration problems. Replace the example hostname with your own domain; do not test only while authenticated, because a logged-in session can hide access restrictions. -
Refresh permalink rules
Go to Settings → Permalinks and click Save Changes without changing the selected structure. WordPress calls this flushing the permalink rules. Test the editor again. This is useful for stale rewrite rules, but it cannot repair a blocked request, a PHP fatal error, a bad proxy configuration, or a host outage.
-
Compare both site URLs and HTTPS
Open Settings → General and compare WordPress Address (URL) with Site Address (URL). Confirm that both use the intended hostname and scheme, including whether the site uses
www. Remove accidental HTTP-to-HTTPS, HTTPS-to-HTTP, or www/non-www mismatches. Site Health also reports the Home URL, Site URL, and HTTPS status. If the site is behind a reverse proxy or CDN, its HTTPS setting must agree with WordPress’s view of the connection. -
Temporarily isolate plugins and the theme
Use Health Check’s Troubleshooting mode when available; it lets you test with plugins disabled for your session without affecting visitors. Otherwise, make a maintenance window, deactivate plugins, and switch to a current default theme. Try the same save. If it works, reactivate plugins and the original theme one at a time, testing after each change. The component that makes the error return is the conflict to update, reconfigure, replace, or report to its developer.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Investigate security and delivery blocks
For a 403, “access denied” text, CAPTCHA, or other HTML challenge, inspect ModSecurity, a web application firewall (WAF), CDN rules, host firewalls, and security-plugin logs. Check both
/wp-json/and the specific route shown in Network; a plugin can use a namespace such as/wp-json/example/v1/...that is blocked separately. Permit the legitimate route for authenticated administrators, then retest. Do not disable every security control permanently. -
Escalate genuine server failures
For 500 responses, PHP fatal messages, connection timeouts, or resource-saturation symptoms, contact the host or server administrator. Send the endpoint, timestamp with time zone, status code, response body, and whether
/wp-json/also fails. Ask for web-server, PHP-FPM, WAF, and application error-log review. Resaving permalinks will not fix an exhausted process pool, a crashed PHP worker, or an upstream outage.
What a healthy REST response should look like
The root /wp-json/ check is a quick reachability test, not a complete publishing test. A healthy response should arrive without an unexpected redirect and should have a JSON content type with a body containing API metadata. The save request itself should also return a successful HTTP status and JSON. If the root endpoint works but the update request fails, compare the two URLs, methods, and response bodies: the longer route may belong to a plugin or may be subject to a narrower firewall rule.
Save the first lines of an HTML response before refreshing or clearing caches. A branded login page indicates authentication or a redirect, while a server-generated error page points to the web server or proxy. A PHP warning printed before JSON can make an otherwise valid response unparsable, so the warning’s file and line number are useful evidence for the developer or host.
Use the status code to choose the repair
| What you see in Network or Site Health | Most likely layer | Next action |
|---|---|---|
404 on /wp-json/ or a REST route |
Permalink, rewrite, or web-server routing | Save the permalink settings; then verify Apache or Nginx rewrite rules and the server’s document root. |
| 403, CAPTCHA, “access denied,” or security HTML | WAF, ModSecurity, CDN, or security plugin | Review firewall logs and allow the affected REST route for the required authenticated request. |
| 301/302 loop or an HTTP-to-HTTPS bounce | WordPress URLs, reverse proxy, or SSL configuration | Align WordPress Address, Site Address, proxy HTTPS handling, and the canonical hostname. |
| 500, PHP warning, or fatal error | Plugin, theme, PHP runtime, or host | Isolate components, enable appropriate server-side logging, and have the host inspect PHP and web-server logs. |
| Timeout or connection failure | Host capacity, network, loopback, or firewall | Provide the failed endpoint and timestamp to the host and request connectivity and resource checks. |
| Saves work only with one plugin disabled | Plugin or theme conflict | Identify the component through one-at-a-time reactivation, then update, reconfigure, replace, or report it. |
Fix a 404: REST routing and rewrite rules
Flush WordPress’s permalink rules
Go to Settings → Permalinks, leave the structure unchanged, and select Save Changes. This regenerates WordPress’s rewrite rules. Return to the logged-out /wp-json/ test and then retry the editor.
Verify Apache or Nginx configuration
If the endpoint remains a 404, the web server may not be forwarding REST paths to WordPress. Apache sites should have the WordPress rewrite directives in the correct document-root .htaccess file, with overrides permitted by the virtual host. Nginx sites need a location rule that sends non-file requests to the WordPress front controller, commonly index.php. A missing Nginx rewrite can leave normal pages working while REST routes fail. Only a server administrator should edit production configuration; save a backup and reload the service using your host’s documented procedure.
Check for a route-specific 404
If /wp-json/ returns JSON but the save request’s longer route returns 404, the problem may be a disabled or broken plugin endpoint rather than core routing. Note the namespace and route in Network, confirm the responsible plugin is active, and test after updating or restoring that component.
Fix redirects and HTTPS mismatches
Make the two WordPress URLs agree
In Settings → General, ensure WordPress Address and Site Address use the same intended scheme and hostname. A site configured for HTTPS must not send the editor to an HTTP API URL, and a canonical www choice must be consistent. Change one value at a time and test in a private browser window.
Recommended Free Tools
Check reverse proxies and CDNs
When TLS terminates at a proxy, the origin server may incorrectly believe the request is HTTP and redirect it back to HTTPS, creating a loop. Have the administrator verify that the proxy forwards the original protocol and that WordPress is configured to trust that signal. Purge only the relevant cache after the origin responds correctly; caching cannot repair a redirect generated by the origin.
Rank #3
Fix a 403 or HTML security challenge
Identify exactly what was blocked
Inspect the response body and firewall log for the complete path, request method, user, and rule ID. A broad /wp-json/ denial can break every editor action, while a narrowly blocked namespace affects only one plugin’s fields or settings. A CDN challenge page, ModSecurity message, and security-plugin denial require changes in different control panels.
Allow the minimum necessary traffic
Create a narrowly scoped exception for the legitimate REST route, authenticated administrator traffic, or the specific rule that produced the false positive. Keep rate limits, authentication, and logging enabled. Retest from the editor and with the logged-out endpoint test. If the block returns, compare the new request with the rule log rather than disabling the entire WAF.
Fix 500 responses and PHP errors
Use the response body and logs
A 500 response may include a PHP warning or fatal message in the Network panel, although production sites often replace it with a generic page. Match the request timestamp to PHP, PHP-FPM, web-server, and WordPress debug logs. Look for a plugin function, theme code, memory exhaustion, uncaught exception, or incompatible PHP version.
Free tools Windows power users keep installed
One-click scans. No signup required.
Perform a reversible conflict test
With a backup and a maintenance plan, use Troubleshooting mode or deactivate all plugins and switch to a default theme. Save a test post. If the error disappears, reactivate one component at a time until the failure returns. Update the offending component and WordPress, review its settings, or replace it. Do not leave a production site with plugins disabled if they provide security, backups, or other essential functions.
Fix timeouts and connection failures
A timeout can occur before WordPress creates any response. Check whether ordinary pages and /wp-json/ are slow or unavailable, and note whether the failure affects every user or only one network. Hosts should inspect CPU and memory pressure, PHP-FPM worker limits, database connectivity, firewall egress rules, DNS, and loopback requests. Provide the exact endpoint and timestamp so logs can be correlated. Increasing a timeout without removing the underlying saturation can make the queue worse.
Use a controlled change order
Make one change, repeat the same test, and record the result. Start with observation: Site Health, the Network request, and the logged-out API check. Next apply low-risk WordPress changes, such as resaving permalinks or correcting an obvious URL mismatch. Then perform a controlled plugin or theme isolation. Server, proxy, CDN, and WAF changes should be made by the responsible administrator with a rollback plan. This order preserves the evidence and prevents a temporary success from hiding a second problem.
Before deactivating a security, backup, or caching plugin, confirm that you have a current backup and know how to restore its settings. Use a staging copy or Troubleshooting mode where possible. If a change affects visitors, announce a short maintenance window and restore the original configuration immediately after the test. Never copy an exception from one site to another without checking the exact hostname, route, and rule ID.
Confirm the repair without guessing
-
Open
https://your-domain.example/wp-json/while logged out and confirm that it returns JSON rather than an HTML page, redirect, or error. -
Log in, open the affected post, make a small harmless change, and click Update. In Network, confirm the REST request returns a success status and a JSON response.
-
Reload the post and verify that the change persisted. Test a second post or page to distinguish a site-wide problem from a route used only by one plugin.
-
Re-enable any temporarily disabled plugin or theme one at a time, testing after each. Restore security rules after a narrowly scoped exception is confirmed.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Record the final URL, status, and component change in the site’s maintenance notes so a recurring failure can be traced quickly.
When to involve your host or security administrator
Escalate rather than repeatedly changing WordPress settings when the evidence shows a persistent 403, 500, timeout, redirect loop, or resource problem. Include:
- the complete REST URL and HTTP method;
- the exact UTC or local timestamp and time zone;
- status code, response headers, and the first part of the response body;
- the result of the logged-out
/wp-json/test; - Site Health messages and whether permalinks were resaved;
- the list of plugins or theme disabled during isolation; and
- whether the site uses Nginx, Apache, a reverse proxy, CDN, WAF, or managed firewall.
This information lets the administrator search the correct web-server, PHP-FPM, WAF, and application logs instead of treating the editor banner as a content error. Ask the administrator to confirm not only that the homepage loads, but that the exact REST route and method now return JSON. A homepage test alone can miss a namespace-specific denial or a PHP error triggered only by authenticated saves.
Common mistakes that prolong the problem
- Changing many settings simultaneously: you lose the evidence showing which layer failed. Capture the request first.
- Assuming the post is corrupt: invalid JSON describes the server response, not the wording of the post.
- Resaving permalinks for every symptom: it helps rewrite failures only; it cannot repair a WAF, PHP fatal, redirect loop, or outage.
- Disabling security globally: use the smallest route or rule exception and keep authentication and logging in place.
- Testing only while logged in: a session can hide a public routing or redirect problem; test
/wp-json/logged out as well. - Leaving troubleshooting changes in production: restore the original theme, plugin state, and firewall policy after the controlled test.
- Clearing caches first: a cache purge cannot correct a 404 rewrite, a PHP fatal, or a firewall rule. Identify the origin response before changing delivery settings.
- Editing server files without a rollback: incorrect rewrite or proxy changes can take down more than the editor. Save the current configuration and use the host’s documented reload process.
The practical diagnosis
The fastest reliable fix is to stop treating the banner as a WordPress-content problem. Read the failed REST request: a 404 sends you to rewrites, a 403 to security controls, a redirect to URL or proxy settings, a 500 to PHP or application logs, and a timeout to hosting and connectivity. Once /wp-json/ returns JSON and the save request receives a successful JSON response, the Block Editor can publish normally.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Frequently Asked Questions
Can invalid post content cause this JSON error?
Usually no. The message means the editor could not parse the server’s response to its REST API save request. Check the request status and response body before changing the post.
What should I do if /wp-json/ returns 404?
Save Settings → Permalinks without changing the structure, then test again. If it remains a 404, have the administrator verify Apache or Nginx rewrite rules and the document root.
Why does the error disappear when I disable a plugin?
That points to a plugin or theme conflict, or to a route that the component registers. Reactivate components one at a time, identify the trigger, then update, reconfigure, replace, or report it.
Is it safe to disable my firewall to test?
Avoid disabling security globally. Review the WAF, ModSecurity, CDN, host-firewall, or security-plugin log and create the narrowest exception for the legitimate REST route, while keeping authentication and logging enabled.
What information will my host need?
Provide the exact REST URL and method, timestamp and time zone, status code, headers, response body, logged-out /wp-json/ result, Site Health messages, and details of any proxy, CDN, WAF, server, plugin, or theme testing.
Why does the homepage work while publishing fails?
The homepage and the editor can use different routes. A missing rewrite, blocked plugin namespace, PHP error, or authentication-specific rule may affect only the REST save request. Test the exact route shown in Network.
The Bottom Line
Find the failed REST request first. Its status and response body tell you whether to repair rewrites, URLs, security rules, a plugin, PHP, or hosting; once the route returns valid JSON, publishing works again.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
