You’re building a block. Connecting a headless frontend. Or just trying to use the Site EditorA user role allowed to create, edit, publish, and delete pos... More. Everything seems correct. Then you hit the browser console and see it:
GET /wp-json/wp/v2/posts → 404 Not Found
Or worse:
403 Forbidden
The WordPress REST API should work out of the box. But sometimes it doesn’t. And the error messages can be misleading.
This guide explains why REST API requests fail with 404 or 403 errors — even when you’ve done nothing wrong — and how to fix them.
The WordPress REST API is a powerful tool. It allows external applications (and the block editorA user role allowed to create, edit, publish, and delete pos... More) to interact with your site.
What should happen:
https://yoursite.com/wp-json/ should return a JSON objecthttps://yoursite.com/wp-json/wp/v2/posts should return a list of postsWhat actually happens sometimes:
The key insight: 404 and 403 errors on REST API endpoints usually aren’t authentication issues. They’re almost always server configuration problems.
| Error | What It Means | Most Common Cause |
|---|---|---|
| 404 | Endpoint not found | Permalinks, .htaccess, or Nginx config |
| 403 | Access denied | Security pluginSoftware that adds specific features or functionality to a W... More, hosting firewall, or server rules |
A 404 on wp-json means the server doesn’t recognize the REST API routes. The request reaches WordPress, but something is blocking the rewrite rules.
The REST API requires pretty permalinks. If your permalinks are set to “Plain” (?p=123), REST routes return 404.
Check: Settings → Permalinks → Is anything other than “Plain” selected?
Fix: Select any option other than “Plain” (e.g., “PostDynamic, time-based content (e.g., blog entries) displayed i... More name”) and click Save Changes.
Why this works: Saving permalinks regenerates the .htaccess file (Apache) or flushes rewrite rules.
On Apache servers, rewrite rules live in .htaccess. If this file is missing or corrupted, REST routes return 404.
Fix via WordPress:
Fix via FTP:
.htaccess (enable hidden files if needed)apache
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
If you use Nginx, you need explicit rewrite rules. The standard WordPress Nginx config must include:
nginx
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ ^/wp-json/ {
try_files $uri $uri/ /index.php?$args;
}
Fix: Add the wp-json location block to your Nginx server configuration, then reload Nginx (sudo systemctl reload nginx).
Don’t have access? Contact your hosting support and ask them to ensure REST API rewrite rules are in place.
Some plugins intentionally disable the REST API for “security” (which is usually unnecessary and breaks functionality).
Common culprits:
Fix:
https://yoursite.com/wp-json/Some managed WordPress hosts block REST API access for unauthenticated users by default. This is rare, but happens.
Known hosts with this behavior (in certain configurations):
Fix: Contact your host and ask:
“Is the WordPress REST API enabled for unauthenticated requests? I’m getting a 404 on
/wp-json/.”
A 403 error means the server understood the request but is refusing to fulfill it. This is usually an authentication or security issue.
Most security plugins have a feature to block REST API access for non-logged-in users.
Check your security pluginSoftware that adds specific features or functionality to a W... More settings for:
Fix: Whitelist the specific endpoints you need, or disable REST API blocking entirely (it doesn’t meaningfully improve security in most cases).
Popular plugins with REST restrictions:
Some hosting providers use ModSecurity or similar WAFs (Web Application Firewalls) that block REST API requests containing certain patterns.
Common patterns that trigger blocks:
Fix:
wp-json/* pathsCustom .htaccess rules may explicitly block access to wp-json.
Check your .htaccess for:
apache
Deny from all
<Files "wp-json">
Deny from all
</Files>
Fix: Remove any rules that block wp-json or the REST API.
Some REST API endpoints require authentication:
edit_posts capability)moderate_comments)list_users)If you’re calling these endpoints without authentication, you’ll get a 403.
Fix: Add authentication to your requests:
wpApiSettings.nonceExample of adding nonce to fetch request:
javascriptA programming language used to create interactive elements o... More
fetch('/wp-json/wp/v2/posts', {
headers: {
'X-WP-Nonce': wpApiSettings.nonce
}
})
CDNs and firewalls sometimes block REST API requests, especially if they contain JSON payloads.
Fix:
*/wp-json/*Follow this checklist in order. Test after each step.
Step 1: Test the base REST endpoint
https://yoursite.com/wp-json/ in your browsername, description, url, etc.Step 2: Save permalinks
Step 3: Disable all plugins
https://yoursite.com/wp-json/Step 4: Switch to a default themeTheme A collection of files that determine a site's design, ... More
Step 5: Check your .htaccess file
.htaccess in your WordPress rootStep 6: Check server rewrite rules (Nginx only)
wp-json location blockStep 7: Check security plugins
Step 8: Check your hosting firewall
/wp-json/*Step 9: Enable WordPress debugging
Add to wp-config.php:
php
define('WP_DEBUG', true);
define('WP_DEBUG_LOG', true);
define('WP_DEBUG_DISPLAY', false);
Then check wp-content/debug.log for REST API-related errors.
https://yoursite.com/wp-json/bash
curl https://yoursite.com/wp-json/wp/v2/posts
Expected output: JSON array of posts (may be empty).
bash
curl -I https://yoursite.com/wp-json/
Expected: HTTP/1.1 200 OK (not 404, 403, or 301/302 redirects).
bash
curl -X GET https://yoursite.com/wp-json/wp/v2/users/me \ --header 'X-WP-Nonce: YOUR_NONCE' \ --cookie 'wordpress_logged_in_YOUR_HASH'
REST API 404 and 403 errors are almost always server configuration or security pluginSoftware that adds specific features or functionality to a W... More issues — not bugs in WordPress itself.
The golden rule: Start by saving permalinks. It’s simple, fast, and fixes 50% of 404 errors.
If that doesn’t work, disable all plugins and switch to a default themeTheme A collection of files that determine a site's design, ... More. This isolates whether the problem is in your configuration or your hosting environment.
And remember: Most 403 errors are security plugins doing their job too aggressively. Review your security plugin’s REST API settings before assuming anything else is broken.
