Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalliTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A “blocked” WordPress REST API request can mean several different things: a broken /wp-json/ route, an endpoint that is not registered, rejected credentials or permissions, or server configuration that drops headers or query parameters. Capture the exact request URL, method, HTTP status, and response body first; then follow the branch that matches the symptom. Do not disable the REST API as a blanket fix: WordPress warns that doing so breaks Admin functionality that depends on it.
What “blocked” means—and what to record first
The WordPress REST API sends and receives JSON. The Block Editor and modern plugin interfaces rely on it, so an error does not automatically mean the whole API is disabled. The status code is useful evidence, but by itself it does not identify the cause; interpret it alongside the endpoint, request method, authentication state, and response body. See the WordPress REST API Handbook and its API usage guidance.
- Request: Copy the full URL, including its path and query string, and note whether the method is GET, POST, or another method.
- Access context: Record whether the request is public or authenticated, which user is making it, and whether credentials are expected.
- Result: Save the HTTP status and the complete response body, which is often a JSON error object.
- Scope: Note whether the failure affects only one endpoint or also the API root.
These details help distinguish a route or server issue from an access-control failure. If the checks below do not resolve it, give them to the site’s administrator or hosting support rather than weakening security broadly.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Does the API root return 404?
When pretty permalinks are enabled, try opening https://example.com/wp-json/, replacing the example domain with the site’s own. A 404 at this address can point to permalink or rewrite routing rather than a disabled API. WordPress’s key concepts documentation recommends enabling pretty permalinks or trying the rest_route form when /wp-json/ returns 404.
#1 Best Overall
Try the query-parameter route
On a site that does not use pretty permalinks, test the API root with https://example.com/?rest_route=/. WordPress’s discovery documentation describes this alternate route form and the related Link header. If the query-parameter form works but /wp-json/ does not, investigate permalink and rewrite handling before changing API permissions.
Ask who owns the routing configuration
Permalink settings are a WordPress-level check; rewrite rules and request forwarding may involve the web server or hosting environment. If you cannot manage those settings, ask the site administrator or host to review routing. Avoid editing live server configuration without confirming which server and setup the site uses.
Does the API root work, but the endpoint is missing?
An API root response does not guarantee that every expected endpoint exists. The root index lists the routes and namespaces registered on that installation. Inspect it for the namespace and route you need, then check the relevant endpoint documentation to confirm the supported path and method.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Core routes and plugin routes are not interchangeable: a route supplied by a plugin will not appear if that plugin has not registered it. Confirm the exact endpoint and HTTP method rather than assuming every WordPress site exposes the same routes. The REST API reference documents core endpoints; the site’s API index shows what is available on that installation.
Is the request being rejected for authentication or permissions?
Public content is generally readable without logging in, while private content and many management actions require authentication. For the failing endpoint, check that the route supports the method being sent, credentials reach WordPress, and the authenticated user has the capability required for that action. A valid login alone does not grant every user permission to change site data. WordPress explains REST API authentication in its authentication documentation.
Check whether the Authorization header reaches WordPress
In some CGI environments, the web server may strip the Authorization header before WordPress receives it. WordPress’s REST API FAQ gives Apache and Nginx configuration examples for passing authorization information through, including Apache’s SetEnvIf Authorization and Nginx’s fastcgi_pass_header Authorization.
These are environment-specific server configuration changes, not code to paste indiscriminately. Ask the administrator or host to verify the server setup and adjust it if appropriate. Retest with the intended user and request after the change.
Free tools Windows power users keep installed
One-click scans. No signup required.
Are query parameters being ignored?
If parameters such as pagination or embedding have no effect, the server may not be forwarding the query string to WordPress. The WordPress FAQ identifies an Nginx try_files configuration that preserves query arguments using $is_args$args as one possible cause and correction. This is not a universal fix for every web server, proxy, or routing problem.
Best Value
Have the server administrator or host inspect the active Nginx configuration and confirm how the request is forwarded before changing a live server. If the URL’s query string reaches WordPress correctly, look again at the endpoint and its supported parameters.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep the REST API available; apply access controls deliberately
WordPress says: “You should not disable the REST API; doing so will break WordPress Admin functionality that depends on the API being active.” If a site has a specific access-control requirement, the REST API FAQ documents using the rest_authentication_errors filter to require login rather than turning the API off altogether. Test any restriction against the Block Editor and the plugins and users the site needs.
Preserve the normal permission checks and avoid broad security changes as a troubleshooting shortcut. WordPress’s security guidance recommends validating and sanitizing input, escaping output, and keeping code current. Apply the narrowest change that addresses the observed failure.
Choose the next step from the symptom
| Observed symptom | First check | Who may need to act |
|---|---|---|
/wp-json/ returns 404 |
Pretty permalinks and the rest_route=/ form |
WordPress administrator; possibly server or host support |
| API root responds, expected route is absent | Root index, namespace, endpoint, and supported method | WordPress administrator or the plugin responsible for the route |
| Private read or write request is rejected | Authentication, transmitted credentials, method, and user capability | WordPress administrator; possibly server or host support for stripped headers |
| Query parameters appear to have no effect | Endpoint parameter support and server forwarding of the query string | Server administrator or hosting support if forwarding is at fault |
If you escalate the issue, include the captured URL and method, status and response body, whether the request was authenticated, and which checks succeeded. Do not send passwords or secret tokens in an ordinary support message.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
