PAGUP Agent ControlWordPress access for AI assistants
Start free trial

WordPress /wp-json/ Returns 404: REST API Diagnosis

A plugin, filter or server rule restricts the WordPress REST API.

Request the WordPress REST index and confirm that the expected namespaces and authentication metadata appear.

Likely causes

  • A plugin, filter or server rule restricts the WordPress REST API.
  • The requested REST route or tool is not registered in the active WordPress configuration.
  • Permalink or rewrite configuration prevents the expected REST base path from resolving.
  • The client calls the wrong domain, base path, REST route or MCP endpoint.
  • A redirect changes the scheme, host or path and may also discard authentication headers.

Diagnostic sequence

  1. Request the WordPress REST index and confirm that the expected namespaces and authentication metadata appear.
  2. Test the REST route fallback used when pretty permalinks are unavailable.
  3. Confirm the exact scheme, host, base path and endpoint configured in the client.
  4. Record WordPress, plugin, client, connector and server versions before changing anything.
  5. Trace every redirect and verify whether scheme, host, path and Authorization are preserved.
  6. Review the exact WAF or security-plugin event for the route, method and rule identifier.

Apply the smallest correction

  1. Restore the required REST route or API availability while preserving authentication and permission callbacks.
  2. Align Home URL, Site URL, public host, HTTPS scheme and REST base address.
  3. Remove or correct the redirect that changes the authenticated request unexpectedly.
  4. Adjust only the verified false-positive WAF rule, path or method instead of disabling protection globally.
  5. Correct the client endpoint, transport, tool name or credential reference without broadening WordPress permissions.

Verify the result

  • The REST index responds from the canonical HTTPS URL and exposes the expected namespaces.
  • The authenticated request reaches the canonical endpoint without an unexpected redirect.
  • The approved narrow read succeeds with a reproducible response.
  • The final record contains versions, evidence, change, verification and rollback information without secrets.

What not to do

  • Do not disable or reopen the entire REST API when only one route or policy is involved.
  • Do not disable the WAF or security plugin globally to bypass one request.
  • Do not edit WordPress core or third-party plugin files as the first troubleshooting step.
  • Do not grant administrator access merely to make a connection test pass.
  • Do not expose debug logs or diagnostic endpoints publicly.

Sources and verification

This page was checked against the following primary sources. Last source review: .