The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
A blocked WordPress Ajax request is fixed by identifying which layer rejected it, then correcting only that layer. Open the browser Network panel and inspect the request URL, status code, payload, and response body. A wrong admin-ajax.php URL, missing action, failed nonce, insufficient capability, security-plugin rule, CDN/WAF challenge, server rule, or PHP error each produces a different remedy. Do not start by disabling your firewall or the REST API.
Start by locating the layer that blocked the request
The browser console may say only “Request failed” or “403 Forbidden.” That message does not tell you whether WordPress, a plugin, the web server, or a WAF made the decision. The Network panel does.
- Open browser developer tools and select Network.
- Reproduce the action while recording the request whose type is XHR or fetch. Filter for
admin-ajax.php,wp-json, or the operation’s distinctive name. - Record the complete URL, HTTP method, status, request initiator, request payload or query string, request headers, response headers, and response body.
- Compare a failing request with one made in a working context, such as a logged-in administrator versus a logged-out visitor.
The response body is often decisive. A WordPress-generated JSON error, a nonce message, an HTML login page, a firewall challenge, and a host-branded block page point to different owners. A request that never appears in WordPress or PHP logs was probably stopped upstream by a CDN, host firewall, web-server rule, or network policy.
Understand the two WordPress request systems
Admin Ajax uses one PHP endpoint
WordPress Developer Resources states: “All WordPress AJAX requests must be sent to wp-admin/admin-ajax.php.” The complete address is site-specific, so a script should receive it from PHP rather than guessing the domain or hardcoding a path. WordPress installations in subdirectories, multisite networks, alternate domains, and unusual SSL setups can all make a guessed URL wrong.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Every admin Ajax request also needs an action value. WordPress maps that value to a server callback named wp_ajax_{action} for authenticated users or wp_ajax_nopriv_{action} for visitors who are not logged in. If no matching callback is registered, the request can return an empty or zero-style response even though the endpoint itself is reachable.
REST requests use routes, authentication, and permissions
REST calls use paths under /wp-json/ and are handled by registered routes rather than the Ajax action hooks. They commonly authenticate a logged-in browser with a cookie plus a nonce sent as _wpnonce or the X-WP-Nonce header. A route can therefore be reachable while still returning 401 or 403 because its permission callback, cookie, nonce, or WAF rule rejects the request.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Correct the Ajax URL and action first
Before changing security settings, prove that the request is addressed and routed correctly. Pass the endpoint from PHP into the script:
<?php
wp_enqueue_script(
'site-actions',
get_template_directory_uri() . '/assets/site-actions.js',
array(),
null,
true
);
wp_localize_script(
'site-actions',
'siteAjax',
array(
'url' => admin_url('admin-ajax.php'),
'nonce' => wp_create_nonce('site_action'),
)
);
?>An equivalent data object generated by PHP is fine. The important point is that the browser receives the value returned by admin_url('admin-ajax.php'); jQuery or fetch cannot determine the correct site URL by itself.
Use the supplied value and an action that exactly matches a registered hook:
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
fetch(siteAjax.url, {
method: 'POST',
headers: {'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8'},
body: new URLSearchParams({
action: 'save_preference',
_ajax_nonce: siteAjax.nonce,
preference: 'compact'
})
});<?php
add_action('wp_ajax_save_preference', 'save_preference');
add_action('wp_ajax_nopriv_save_preference', 'save_preference_for_guests');
function save_preference() {
check_ajax_referer('site_action');
if (!current_user_can('edit_posts')) {
wp_send_json_error(array('message' => 'Not permitted'), 403);
}
$preference = isset($_POST['preference'])
? sanitize_key(wp_unslash($_POST['preference']))
: '';
if ($preference !== 'compact' && $preference !== 'comfortable') {
wp_send_json_error(array('message' => 'Invalid preference'), 400);
}
// Perform the authorized operation here.
wp_send_json_success(array('preference' => $preference));
}
?>Use wp_ajax_nopriv_{action} only when an operation is genuinely intended for visitors who are not logged in. Adding that hook to a sensitive operation can expose a write endpoint to the public. A missing hook is a routing problem, not evidence that a firewall should be disabled.
Recommended Free Tools
Repair nonce transport and verification
A nonce proves that a request was generated in an expected WordPress session and context; it is not a login mechanism or a permission grant. WordPress Developer Resources explicitly warns: “Nonces should never be relied on for authentication, authorization, or access control.” Use a nonce check and a separate capability check.
Admin Ajax nonce checklist
- Create the nonce with the action string the handler expects.
- Send it in the field name that the handler verifies. The conventional field is
_ajax_nonce, but a custom field name is valid when passed explicitly tocheck_ajax_referer(). - Pass the same action string to
check_ajax_referer()that was used to create the nonce. - Do not cache a page containing a user-specific nonce for longer than that nonce remains valid. A stale cached page can keep sending an old value.
- Check
current_user_can()before changing data, deleting records, or exposing private information.
For a custom field, make the name explicit:
// PHP
check_ajax_referer('site_action', 'security');
// JavaScript payload
new URLSearchParams({
action: 'save_preference',
security: siteAjax.nonce
});A failed nonce check normally terminates the Ajax request with HTTP 403. If the browser sends no nonce, sends it under the wrong name, uses a nonce generated for another action, or submits a stale cached value, fix that data flow before allowlisting the request.
REST nonce checklist
For a same-origin logged-in REST call, send the nonce in one of WordPress’s expected forms:
fetch('/wp-json/example/v1/preferences', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'X-WP-Nonce': window.wpApiSettings.nonce
},
body: JSON.stringify({preference: 'compact'})
});Also confirm that the browser is sending the authentication cookie when the route requires it and that the route’s permission callback allows the current user. A valid nonce with an insufficient capability is still a 403.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Use the status code and response body as a decision tree
| Status or symptom | Likely causes | Next check |
|---|---|---|
| 401 | Missing or expired authentication, absent cookie, or a route that requires a logged-in user | Inspect cookies, login state, REST authentication, and the route’s permission callback. |
| 403 | Failed nonce, insufficient capability, security plugin, CDN/WAF, ModSecurity, fail2ban, or a server rule | Read the response body and security logs; compare the request payload and user context. |
| 404 | Wrong endpoint path, rewrite issue, or unregistered REST route | Verify the exact admin-ajax.php URL or REST route and inspect rewrite/server configuration. |
| 500 | PHP fatal error, plugin or theme failure, malformed response, or database exception | Check PHP and WordPress logs and reproduce with the suspected component isolated. |
| 200 with empty, “0”, or unexpected HTML | Missing action callback, callback output polluted by warnings, login redirect, or a handler that never sends JSON | Confirm hook registration and inspect the raw response rather than only the JavaScript parser error. |
| Timeout or stalled request | Slow PHP or database work, upstream timeout, overloaded admin-ajax.php, or a blocking challenge |
Check server timing, PHP-FPM and database logs, and any proxy timeout events. |
| Browser CORS error before a response | Cross-origin policy or a failed preflight, often for REST requests with custom headers | Inspect the OPTIONS request and the Access-Control-Allow-Origin, methods, and headers returned. |
A 403 alone does not identify WordPress as the blocker. A WordPress JSON error, a plugin-generated message, and a WAF’s branded HTML page are evidence of different layers.
Handle security plugins and WAF rules without opening the site
Security controls can block the endpoint itself or a parameter inside an otherwise legitimate request. A documented Wordfence support case describes its firewall blocking /wp-admin/admin-ajax.php. The safe diagnostic workflow is to put the firewall into Learning Mode, perform the blocked action once, then return it to Enabled and Protecting. The alternative is to use Live Traffic to identify the specific request and allowlist the necessary parameter or rule.
Learning Mode is a temporary observation step, not a permanent configuration. Keep the test short, perform only the expected action, and restore protective mode immediately. If a rule is needed, make the exception as narrow as the product allows: one action or parameter, one method, and the required authenticated context.
For Cloudflare, a managed host WAF, ModSecurity, fail2ban, or another proxy, inspect the event log using the request timestamp, client IP, path, method, and rule identifier. A rule may be reacting to a parameter value, request rate, country, user-agent, missing cookie, or unusual body encoding. Exempting all of /wp-admin/ or all POST requests removes more protection than the Ajax operation requires.
A separate support case warns that blocking admin-ajax.php can break plugin actions and core functionality. If the request never reaches WordPress, ask the host or WAF administrator to create a logged, reversible exception for the exact legitimate traffic. Keep the rule active for all unrelated requests.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Do not disable the REST API to hide a REST failure
WordPress Developer Resources says: “You should not disable the REST API; doing so will break WordPress Admin functionality that depends on the API being active.” A disabled API can therefore make the dashboard itself fail, not merely break a third-party integration.
When a REST request fails, repair the underlying condition instead:
- For 401 or 403, verify the logged-in cookie,
X-WP-Nonceor_wpnonce, user capability, and route permission callback. - For 404, verify that the route is registered on the current site and that rewrite rules are working.
- For a response blocked by a WAF, inspect the WAF event and narrow the exception to the route, method, and authenticated use case.
- For a browser-only CORS error, determine whether the request is intentionally cross-origin. If it is, the server must return an explicit, appropriate
Access-Control-Allow-Originvalue and allow the requested methods and headers. Do not use a wildcard origin for credentialed requests.
Preflight failures are especially common when JavaScript sends X-WP-Nonce or JSON. The browser may send an OPTIONS request first; if the server or WAF rejects that request, the actual POST never runs. Inspect both requests and configure the cross-origin policy at the server or application layer that owns it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check caching, optimization, and login context
Once the endpoint and security rules look correct, temporarily bypass page caching, JavaScript minification, concatenation, and asynchronous script loading. Optimization can execute a script before its localized data exists, rewrite a URL, strip a request field, or serve a page with an expired nonce. Purge the relevant page and object caches, reproduce the problem, then restore one optimization at a time until the interfering component is identified.
Test every supported context separately:
- Logged in as an administrator or the least-privileged role that should use the feature.
- Logged in as a lower-privilege user, if that role is supported.
- Logged out, only when a
wp_ajax_nopriv_handler or public REST permission is intended. - With browser extensions, corporate proxies, and alternate browsers considered when the server-side request is successful but the page still reports an error.
Do not treat a successful administrator test as proof that public traffic works. Authentication cookies, nonce creation, capability checks, rate limits, and WAF policies can vary by user state.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Follow a complete repair procedure
- Capture the failure. Save the exact URL, method, status, payload, response body, and timestamp from the Network panel.
- Classify the endpoint. Decide whether it is
admin-ajax.phpor a/wp-json/route. - Verify routing. For Ajax, confirm the PHP-generated URL and
action. For REST, confirm the route is registered and returns something other than a path-level 404. - Verify request data. Check nonce field name, action string, cookie, content type, and required parameters. Compare the failing payload with a known-good request.
- Verify authorization. Confirm the callback checks the required capability and validates and sanitizes every input. A nonce check is not authorization.
- Inspect application logs. Look for PHP errors, WordPress notices, route permission failures, and callback output that corrupts JSON.
- Inspect security logs. Check the security plugin, CDN, host WAF, ModSecurity, fail2ban, and web-server rules for the same timestamp and request signature.
- Apply the smallest exception. Allow the single legitimate action, parameter, route, method, or user context. Avoid broad endpoint or directory exclusions.
- Retest both states. Test logged in and logged out when both are supported, and test the REST preflight as well as the actual request when cross-origin access is involved.
- Restore protection and optimization. Exit Learning Mode, return the firewall to its protecting state, and re-enable caching or minification one component at a time.
Choose a fix by scope, evidence, and reversibility
| Fix category | Use when | Preferred scope | Risk if over-broad |
|---|---|---|---|
| Handler or URL correction | The request has a wrong path, missing action, or absent callback | One script and one registered action | The feature still fails, or an unintended public hook exposes functionality. |
| Nonce or authentication repair | The response indicates a failed nonce, missing cookie, or expired session | One action or REST route and its expected field/header | Allowlisting the request would bypass the real security check. |
| Capability and validation repair | The user is authenticated but lacks permission or sends invalid input | One callback’s permission and input checks | Granting a role or skipping validation can permit unauthorized changes. |
| Security-plugin exception | The plugin log identifies a false positive | One rule, parameter, method, and context | Disabling the firewall or excluding all Ajax traffic removes unrelated protection. |
| CDN or host-WAF exception | An upstream event log shows the rejection | One route or parameter with logging retained | Allowing all of /wp-admin/ or all POST requests creates a large attack surface. |
| Server-rule correction | NGINX, Apache, ModSecurity, fail2ban, or rewrites stop the request | The exact rule and request signature | Changing global rewrite or security rules can affect every site operation. |
| REST repair | The API is disabled, route permissions fail, or CORS preflight is rejected | Restore the API, then fix nonce, permissions, route, or explicit origin policy | Disabling REST can break WordPress Admin and other core features. |
Common failure patterns and their targeted fixes
“It is a 403, so I allowed admin-ajax.php, but it still fails”
The 403 may be a nonce or capability failure generated inside WordPress. Read the response body, verify the nonce field and action, and check the callback’s capability requirement before changing WAF rules.
“The request returns 0”
The endpoint may be functioning while no callback matches the submitted action, or the callback may exit without sending a response. Check spelling and hook registration for both authenticated and public contexts. Also inspect PHP output for warnings that make a JSON response invalid.
“It works for an administrator but not for visitors”
That is expected when only wp_ajax_{action} is registered or when the callback requires a capability. If the operation is intended to be public, add and secure a separate wp_ajax_nopriv_{action} path, validate all input, and rate-limit or otherwise protect any resource-intensive behavior.
“The REST call works in one browser but fails from another origin”
Compare the origins, cookies, preflight response, and requested headers. A same-origin test does not prove that cross-origin CORS policy is configured. Permit only the known origin and required headers, and ensure the server handles OPTIONS without a WAF block.
“The problem appeared after enabling caching or optimization”
Look for a stale localized nonce, a rewritten endpoint, or a script executing before its configuration object. Purge caches, disable one optimization feature, retest, and then re-enable features individually.
What a successful fix looks like
The Network panel should show the intended site-specific endpoint, the expected method and payload, and a response from the correct handler or REST route. The server should verify the nonce where required, enforce the user’s capability independently, validate input, and return a deliberate JSON response. Security and WAF logs should show either no block or a narrowly scoped rule that permits this request while continuing to inspect unrelated traffic. Finally, the same behavior should be confirmed in every user context the feature promises to support.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
