WordPress REST API Errors and 401/403 Responses

Warning Frequency: Uncommon

Error message: rest_forbidden — Sorry, you are not allowed to do that.

The WordPress REST API is used by the block editor (Gutenberg), many plugins, and external integrations. When it’s blocked or returning errors, the block editor may not work, plugins may fail, and API-dependent features break.

Common Causes

Security plugin blocking REST API access
Authentication not configured for the endpoint
.htaccess rules blocking /wp-json/ requests
Permalink structure not set (REST API needs pretty permalinks or index.php prefix)
Server blocking HTTP methods (PUT, DELETE, PATCH)

How to Fix It

Check if REST API is accessible: Visit /wp-json/wp/v2/ in your browser
Ensure pretty permalinks are enabled (Settings > Permalinks u2014 anything except 'Plain')
Check security plugins: iThemes, Wordfence, and similar plugins can block REST API. Whitelist needed endpoints
For authentication: Use Application Passwords (built into WordPress 5.6+) or a JWT plugin
Check .htaccess for rules blocking /wp-json/ and ensure the WordPress rewrite rules are intact

⚡

Diagnosing WordPress errors?

WP Multitool helps you find and fix performance issues, slow queries, and plugin conflicts without guesswork.

Try WP Multitool →