The “background request was blocked” message in WordPress Site Health is a diagnostic result, not a single defect. WordPress is failing to connect back to its own public URL, reach a REST API test, or make an outbound HTTP request. The reliable fix is to identify the failing test and response first, then isolate plugins and themes, check WordPress HTTP restrictions, inspect REST and web-server controls, and involve your host if the block is outside WordPress.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What the background-request warning means
WordPress Site Health runs tests for background updates, loopback requests, REST API availability, and HTTP requests. A loopback is WordPress connecting back to its own public site. As WordPress Developer Resources puts it, “A loopback request is when WordPress tries to connect back to its own site.”
As an Amazon Associate I earn from qualifying purchases.
Those self-requests are used for WP-Cron scheduled events and for checking whether plugin or theme changes can be made safely. The block editor also depends on a working REST API. If the request cannot complete, Site Health reports a warning even when ordinary visitors can still load the home page.
The message therefore does not identify one universal cause. The failing layer can be a plugin or theme, a WordPress HTTP restriction, REST access control, web-server configuration, TLS or SSL, DNS, HTTP authentication, a reverse proxy, or a host firewall. Treat the warning as a starting point for diagnosis rather than as proof that WordPress itself is broken.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Capture the exact failure before changing settings
Do not begin by disabling security controls or editing wp-config.php. First preserve the evidence that tells you which layer is failing.
- Sign in to WordPress and open Tools > Site Health.
- Expand the tests for REST API, loopback requests, background updates, and HTTP requests. Read the detailed text rather than relying on the headline warning.
- Record the HTTP status, cURL message, timeout text, or TLS error exactly as shown. A 403, 404, 5xx response, timeout, and certificate error lead to different investigations.
- Note the time and timezone displayed by your server or monitoring system. You will use that timestamp to match web-server, firewall, proxy, and security-plugin logs.
- Write down whether the impact is limited to Site Health or whether scheduled events, automatic updates, the block editor, or another REST-dependent integration is also failing.
WordPress exposes the tests through REST routes including /wp-site-health/v1/tests/background-updates and /wp-site-health/v1/tests/loopback-requests. A failure in one route does not automatically prove that every REST route is unavailable; use the detailed result to determine the scope.
Recommended Free Tools
Isolate plugins first
Deactivate regular plugins
Temporarily deactivate all standard plugins, then return to Site Health and run the test again. This is a diagnostic change: it removes plugin code and plugin-added security hooks from the request path without permanently changing your chosen configuration.
If the warning clears, reactivate plugins one at a time, retesting after each activation. The plugin activated immediately before the warning returns is the likely conflict. Keep a short record of the activation order and the exact status message so you can reproduce the result or report it to the plugin author.
Include must-use plugins when possible
Must-use plugins are loaded outside the usual Plugins screen and can continue filtering requests after ordinary plugins are deactivated. If your host or administrator permits it, inspect the must-use plugin directory or ask the host to disable those components temporarily for a controlled test. Do not delete a must-use plugin merely to make the warning disappear; preserve a copy and understand what it controls.
Use a safe test window
Deactivating plugins can remove caching, authentication, commerce, or security functions. Perform the test during a maintenance window, restrict access if necessary, and reactivate unaffected plugins promptly. The goal is to identify the layer, not to run a production site indefinitely with protections disabled.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Test the active theme
If all plugins are inactive and the loopback or REST test still fails, switch temporarily to a bundled default WordPress theme. A theme can add request filters, authentication checks, REST restrictions, or code that causes a fatal error during a self-request.
Run Site Health again after the switch. If the warning disappears, the original theme is implicated. Review its custom security hooks and recent changes, and ask its developer to investigate the failing route and response. Restore the original theme only after recording the test result; otherwise you lose the comparison that identifies the conflict.
If the warning remains with a default theme and no regular plugins active, the probability shifts toward WordPress configuration, the server, the network path, or the host’s security controls.
Check WordPress HTTP restrictions
Review WP_HTTP_BLOCK_EXTERNAL
Open wp-config.php and search for WP_HTTP_BLOCK_EXTERNAL. When this constant is enabled, WordPress blocks outbound HTTP requests unless the destination is explicitly allowed. A self-request can therefore fail even though the site is publicly reachable in a browser.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Do not remove a deliberate restriction simply to clear Site Health. It may be part of an organization’s security policy. Instead, determine whether the site’s own hostname and any required service hostnames are permitted.
Check WP_ACCESSIBLE_HOSTS
WP_ACCESSIBLE_HOSTS defines exceptions to the external-request block. Values are comma-separated hostnames and may include wildcard domains. An illustrative configuration is:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
define( 'WP_HTTP_BLOCK_EXTERNAL', true );
define( 'WP_ACCESSIBLE_HOSTS', 'site.example,*.example.net' );Use the actual hostname WordPress needs, including the hostname used in the Site Health detail. A mismatch between the site’s configured URL and the allowed hostname can leave the request blocked. After any change, save the file, rerun the test, and remove an exception that is no longer required.
Check URL and protocol consistency
Compare the site URL WordPress uses with the public address shown in the failed request. Differences such as an HTTPS address being redirected to HTTP, a noncanonical hostname, or a host alias that resolves elsewhere can send the self-request through a different rule set. Make one configuration change at a time so the resulting test identifies the cause.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Inspect REST access and edge controls
Security plugins, web-application firewalls, ModSecurity rules, reverse proxies, HTTP authentication, DNS, and TLS configuration can reject a request generated by the site itself. A browser test from your workstation may succeed while a server-originated request is denied, challenged, or routed to a different backend.
Security plugins and WAF rules
Look for rules that block requests to wp-json, the Site Health routes, requests without a browser user-agent, or requests originating from the server’s own address. Temporarily disabling a rule for a controlled test is safer than removing an entire security layer. Re-enable the protection immediately after the comparison.
Reverse proxies and HTTP authentication
A proxy can require credentials, rewrite the hostname, or route internal requests to a backend that does not recognize the public URL. Basic authentication on a staging or protected site can similarly prevent WordPress from completing its own request. Ask whoever manages the proxy or authentication layer whether unauthenticated requests from the application server are allowed to reach the REST and loopback routes.
DNS and TLS/SSL
The server must resolve the site hostname and establish a trusted connection to the address returned by DNS. Incorrect records, split-horizon DNS, an expired certificate, a certificate for the wrong hostname, or an incomplete certificate chain can produce a timeout or TLS error before WordPress handles the request. Compare the hostname and certificate named in the Site Health message with the DNS and TLS configuration at the time of failure.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Use logs at the same timestamp
Check the web-server access and error logs, WAF or ModSecurity logs, reverse-proxy logs, and host firewall logs using the timestamp recorded from Site Health. Look for the requested path, response code, source address, redirect chain, and the rule that acted on the request. This correlation is more reliable than guessing from the warning text alone.
Use the response to choose the next layer
| Observed result | Most likely area | What to verify |
|---|---|---|
| 403 Forbidden | Access control | Security-plugin rules, WAF or ModSecurity, HTTP authentication, proxy policy, and host firewall logs. |
| 404 Not Found | Routing or REST exposure | Whether the requested REST or Site Health route is enabled, rewritten correctly, and reaching the intended WordPress installation. |
| 5xx response | Application or server failure | PHP or web-server error logs, fatal errors from a plugin or theme, and upstream proxy errors at the same timestamp. |
| Timeout | Routing or firewall | DNS resolution, outbound firewall rules, proxy reachability, and whether the server can connect to its public address. |
| TLS or certificate error | HTTPS configuration | Certificate hostname, validity, chain, protocol termination at a proxy, and the DNS address reached by the server. |
These are working hypotheses, not automatic diagnoses. A 403 usually suggests access control, a timeout often suggests routing or a firewall, and a TLS error points toward certificate or hostname configuration, but the logs must confirm which component made the decision.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When and how to involve your hosting provider
Escalate after plugin and theme isolation and the WordPress configuration checks do not resolve the failure, or whenever the logs show a server-side rejection. Ask the host to investigate the site’s own public URL from the application server, not merely from an external browser.
Give support a concise diagnostic packet:
- The exact Site Health message and HTTP status or cURL/TLS text.
- The failed route, such as
/wp-site-health/v1/tests/loopback-requests, when shown. - The timestamp, timezone, site hostname, and whether the request used HTTP or HTTPS.
- Whether all plugins were deactivated, a bundled theme was tested, and the result of each test.
- Whether scheduled events, automatic updates, the block editor, or other REST integrations are affected.
Ask specifically whether server-side security rules, a host firewall, DNS, SSL, or HTTP authentication blocks requests from the site back to its own URL. This wording directs the investigation to the documented failure modes instead of producing a generic “WordPress is healthy” check from outside the server.
Retest the features that depend on the request
After the warning clears, do not stop at the green Site Health result. Confirm the dependent behavior that mattered to your site:
- Check that scheduled events run and no longer accumulate as missed or failed jobs.
- Verify that automatic background updates report normally.
- Open the block editor, load an existing post, and save a harmless draft to confirm REST requests complete.
- Test any integration that reads or writes through the WordPress REST API.
- Re-enable plugins, theme code, firewall rules, and authentication controls that were disabled for diagnosis, then rerun Site Health after each major restoration.
If the warning returns only after one component is restored, keep that component isolated and document the response code and log entry. A repeatable failure is substantially easier for a developer or host to correct than an intermittent warning with no timestamp.
Common failure patterns and the appropriate fix
The warning appears after installing or updating a plugin
Deactivate all plugins, confirm the warning clears, and reactivate them individually. If one plugin reliably restores the error, inspect its request-blocking, authentication, or REST filters and report the exact route and response to its maintainer. Do not compensate by broadly weakening the firewall or removing WP_HTTP_BLOCK_EXTERNAL.
Site Health fails, but visitors and the editor appear normal
A narrow loopback route can fail while front-end pages still render. Check the detailed route and status, then compare the access and security logs. Also verify WP-Cron and background-update behavior; a page-load test alone does not prove that server-originated requests work.
Everything fails after enabling external-request blocking
Review WP_ACCESSIBLE_HOSTS and allow only the required hostnames, including the site’s own hostname when appropriate. Keep the restriction if it is intentional, and involve the administrator who defined the policy before changing it.
The error occurs only on HTTPS
Check DNS resolution from the web server and the certificate presented for the exact hostname WordPress calls. If HTTPS terminates at a reverse proxy, verify that the proxy forwards the request to the correct backend and that the backend recognizes the original host and protocol.
The result changes from one attempt to another
Record each attempt with its timestamp and response. Intermittent results often indicate a load balancer, firewall rule, DNS split, or multiple application servers with different configuration. Compare logs on every node rather than changing WordPress code after a single successful test.
Prevent the warning from returning
- Keep a written record of intentional HTTP restrictions, allowed hostnames, proxy rules, and authentication requirements.
- When deploying a security or caching change, run the Site Health loopback and REST tests in the same maintenance window.
- Monitor scheduled events and automatic updates, not just front-end uptime.
- Retain web-server, WAF, and firewall logs long enough to correlate a future Site Health timestamp.
- Use the smallest possible exception when a hostname must be added to
WP_ACCESSIBLE_HOSTS, and review that exception when the service is retired.
The practical rule is simple: identify the exact request, preserve its response, isolate WordPress code, then follow the evidence into the server and network layers. Once the self-request succeeds, verify the cron, update, editor, and REST features that rely on it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
