WordPress REST API Not Working 8 Easy, Proven Fixes

By Basharat Ali Khan | Last updated: October 26, 2026

WordPress REST API not working is one of those problems that stays invisible until something breaks. Then the block editor stops saving, Elementor throws errors, a plugin integration fails or a mobile app cannot connect to your site.

The good news is that WordPress REST API not working almost always traces back to a handful of causes, and the error code you see is the fastest way to find the right one. This guide helps you diagnose it by code and fix it step by step.

Quick Answer

WordPress REST API not working is usually diagnosed by opening yoursite.com/wp-json/ and reading the error. A 404 points to permalinks, a 403 to a security plugin or firewall, a 401 to authentication, and a 500 to a plugin or theme crash. Start by resaving your permalinks, then test with plugins switched off.

What Does WordPress REST API Not Working Look Like?

You may not see the words “REST API” at all, because the symptoms usually show up somewhere else:

The block editor shows “Updating failed” or “The response is not a valid JSON response”
Elementor or another builder will not load or save
Site Health reports a problem with the REST API
A plugin, app or integration that talks to your site fails to connect
Visiting /wp-json/ shows an error instead of a page of data

Step 1: Test the API Directly

Before you change anything, check the actual status. Open these two addresses in your browser, replacing the domain with yours:

https://your-site.com/wp-json/
https://your-site.com/?rest_route=/

A working API shows a page of JSON text. This test tells you what kind of WordPress REST API not working problem you have:

404 error: a routing or permalink problem. If the second address works but /wp-json/ does not, the API itself is fine and your rewrite rules are the cause.
403 error: something is actively blocking access.
401 error: an authentication problem, usually affecting specific requests, not the whole API.
500 error: a PHP crash, usually from a plugin or theme.
Blank white page: a hidden fatal PHP error.

Fix 1: Resave Permalinks for a 404 Error

WordPress REST API not working with a 404 error is almost always a permalink problem, because the API uses the same rewrite system as your normal pages.

Go to Settings > Permalinks.
Make sure the structure is not “Plain.” Choose “Post name” instead.
Click Save Changes, even if the setting already looks correct. This rebuilds the rewrite rules.

If it still fails, see my full guide on WordPress permalinks not working, which covers .htaccess, mod_rewrite and Nginx rules in detail.

Fix 2: Check Your Server Rewrite Setup

If resaving permalinks does not help, the server may be ignoring your rewrite rules. On Apache, confirm that mod_rewrite is enabled and that your .htaccess file contains the standard WordPress block. On Nginx, the main location block needs try_files $uri $uri/ /index.php?$args;. If you are not sure, ask your host’s support team to confirm both.

Fix 3: Remove the Block Behind a 403 Error

WordPress REST API not working with a 403 error means the request reached your server but was refused on purpose. This is almost always a security layer working a little too hard.

Security plugins: tools such as Wordfence or All In One WP Security can restrict REST API access for visitors who are not logged in. Check the plugin’s settings for a REST API option, or deactivate it briefly to confirm.
“Disable REST API” plugins: some plugins exist only to turn the API off for logged-out users. If you installed one, it may also break features your own site needs.
Firewall or CDN: if you use Cloudflare or another web application firewall, check its security log for blocked requests to /wp-json/. A rule may be treating normal API requests as suspicious.
Server security rules: some hosts run ModSecurity or similar rules that block certain requests. Ask your host to check their logs.

Fix 4: Fix a 401 Authentication Error

WordPress REST API not working with a 401 error usually means the API itself is fine, but one authenticated request fails. This is common when:

An API key or application password was entered wrongly or has been removed
Application Passwords are used on a site without HTTPS, because WordPress expects a secure connection for them
An app uses an outdated authentication method
The server drops the Authorization header before it reaches WordPress, which happens on some Apache setups

If a server is dropping the header, hosts and developers often add this line inside the mod_rewrite block of the .htaccess file:

RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

Take a backup first. For a specific plugin or app that fails with a 401, check that integration’s credentials before you assume your whole site is broken. Older WooCommerce integrations may also need standard WooCommerce REST API keys.

Fix 5: Find the Plugin or Theme Causing a 500 Error

WordPress REST API not working with a 500 error means something causes a fatal PHP crash when the API is called, even if the rest of your site loads.

Deactivate all plugins temporarily.
Open /wp-json/ again. If it works now, a plugin was the cause.
Reactivate plugins one at a time, checking /wp-json/ after each, until you find the one that breaks it.
If plugins are not the cause, switch to a default theme such as Twenty Twenty-Four for a moment to test your theme.

Do this on a staging site if your live site is busy.

Fix 6: Reveal a Hidden Error on a Blank Page

A blank white page at /wp-json/ also counts as WordPress REST API not working, and it means a fatal PHP error is happening but not being shown. Turn on logging by adding this to your wp-config.php file:

define( 'WP_DEBUG', true );
define( 'WP_DEBUG_LOG', true );
define( 'WP_DEBUG_DISPLAY', false );

WordPress now writes the real error to /wp-content/debug.log. Read it to see which plugin, theme or file is crashing. When you are finished, set WP_DEBUG back to false so the log does not keep growing, and take a backup before editing wp-config.php.

Fix 7: Correct a Site URL or HTTPS Mismatch

WordPress REST API not working after you added SSL, moved hosts or changed domains is often a URL mismatch that quietly breaks API calls.

Go to Settings > General.
Make sure WordPress Address (URL) and Site Address (URL) are identical in protocol (https://) and format (with or without www).
Check that your site does not redirect in a loop between http and https, or between www and non-www.

You can also open Tools > Site Health. If the REST API or loopback request fails there, the message often names the cause, such as a timeout or a blocked request.

Fix 8: Exclude the API From Caching and Check Host Limits

Caching or hosting security rules can also cause WordPress REST API not working, especially when the problem comes and goes.

Make sure your caching plugin or CDN does not cache /wp-json/ requests. API responses should stay dynamic.
Clear your cache after any fix, and test in an incognito window.
If requests time out, ask your host about PHP time limits and server resource limits.

The Block Editor “Not a Valid JSON Response” Error

WordPress REST API not working is also behind the block editor message “Updating failed. The response is not a valid JSON response” (or “Publishing failed”). The editor saves through the REST API, so any of the problems above can trigger it. The most common causes are broken permalinks (Fix 1), a security plugin or firewall block (Fix 3), a site URL mismatch (Fix 7) and a PHP error or warning that spoils the response (Fix 6). Work through those in that order, and the editor error usually disappears with the API problem.

Quick Reference Table

If WordPress REST API not working still leaves you unsure where to start, match your symptom here.

Symptom	Likely cause	Fix
404 at /wp-json/	Broken permalinks or routing	Fixes 1 and 2
403 Forbidden	Security plugin, firewall or server rule	Fix 3
401 Unauthorized	Credentials, HTTPS or missing Authorization header	Fix 4
500 Internal Error	Plugin or theme crash	Fix 5
Blank white page	Hidden fatal PHP error	Fix 6
Broke after SSL or a migration	Site URL mismatch or redirect loop	Fix 7
Works sometimes, fails at other times	Cache or host limits	Fix 8
“Not a valid JSON response” in the editor	Any of the above	The editor section

Frequently Asked Questions

Why did my REST API suddenly stop working?

WordPress REST API not working right after an update is common. A plugin, theme or WordPress core update can change how requests are handled or add a security rule. Check your recent update history around the time the problem started.

Is it safe to disable my security plugin’s REST API restriction entirely?

Not necessarily. Instead of removing all protection, check whether the plugin lets you allow specific trusted requests, such as your own admin functions, while still blocking anonymous outside access.

Does WooCommerce need special REST API handling?

WooCommerce has its own REST API with API keys. If an older integration fails with a 401, check which authentication method it expects and whether you need to create WooCommerce API keys.

Can I test the REST API without technical tools?

Yes. Opening /wp-json/ and /?rest_route=/ in your browser (Step 1) gives you a quick status check and the error code you need.

Do I need a developer to fix this?

WordPress REST API not working is usually fixable without a developer. Most cases are solved by permalinks, a security plugin setting or a plugin conflict. A developer helps with server rules, authentication headers and firewall logs.

Final Thoughts

WordPress REST API not working is much faster to fix once you know the error code: 404s point to permalinks, 403s to security blocks, 401s to authentication and 500s to plugin or theme conflicts. Test the two addresses in Step 1, match the code to the fix, and take a backup before you edit any server files.

Need Help Fixing Your REST API?

If WordPress REST API not working is blocking your editor, Elementor or an integration, contact me here and I will diagnose and fix it directly, or see my WordPress services.

About the author
Basharat Ali Khan is a WordPress developer in Gilgit, Pakistan with 8+ years of experience building custom plugins, Elementor sites and WooCommerce stores.
LinkedIn | WordPress.org profile