PAGUP Agent ControlWordPress access for AI assistants
Start free trial

A Security Plugin or WAF Is Blocking the WordPress REST API

A WAF or security rule blocks the specific REST path, method, payload or authentication pattern.

Capture the exact sanitized message, HTTP status and response body without including secrets.

Likely causes

  • A WAF or security rule blocks the specific REST path, method, payload or authentication pattern.
  • A plugin, filter or server rule restricts the WordPress REST API.
  • The hosting stack, reverse proxy, redirect or WAF removes the Authorization header before WordPress receives it.
  • The client exceeds a request-rate threshold enforced by the application, host or WAF.
  • Another plugin changes HTTPS detection, REST access or Application Password availability.

Diagnostic sequence

  1. Capture the exact sanitized message, HTTP status and response body without including secrets.
  2. Review the exact WAF or security-plugin event for the route, method and rule identifier.
  3. Request the WordPress REST index and confirm that the expected namespaces and authentication metadata appear.
  4. Verify through sanitized server evidence that the Authorization header reaches WordPress.
  5. Separate authentication failure from authorization refusal by comparing status, error code and response context.
  6. Record WordPress, plugin, client, connector and server versions before changing anything.

Apply the smallest correction

  1. Adjust only the verified false-positive WAF rule, path or method instead of disabling protection globally.
  2. Restore the required REST route or API availability while preserving authentication and permission callbacks.
  3. Configure the trusted server or proxy path to pass the Authorization header to WordPress.
  4. Reduce concurrency and retry frequency, then honor any server-provided retry interval.
  5. Escalate with sanitized, versioned evidence when the behavior remains specific to the plugin.

Verify the result

  • The REST index responds from the canonical HTTPS URL and exposes the expected namespaces.
  • Sanitized server evidence confirms that the Authorization header reaches WordPress.
  • The approved narrow read succeeds with a reproducible response.
  • A deliberately forbidden write remains refused.

What not to do

  • Do not disable the WAF or security plugin globally to bypass one request.
  • Do not disable or reopen the entire REST API when only one route or policy is involved.
  • Do not grant administrator access merely to make a connection test pass.
  • Do not place an Application Password, Authorization header, token or cookie in a prompt, ticket, log excerpt or screenshot.
  • Do not expose debug logs or diagnostic endpoints publicly.

Sources and verification

This page was checked against the following primary sources. Last source review: .