You try to publish a post in Gutenberg, and the update button just spins forever. Or your contact form plugin suddenly can’t save settings. Maybe your mobile app stopped syncing with your site.
Check your browser console, and you’ll likely see a 404 or 403 error pointing to /wp-json/wp/v2/. Welcome to the “REST API Disabled” nightmare.
I fixed three of these last week alone. The REST API is the backbone of modern WordPress—Gutenberg, the block editor, most plugins, and headless setups all depend on it. When it’s blocked, half your site stops working.
Let’s get it running again.
What Is the WordPress REST API?
Think of the REST API as a messenger between your WordPress backend and frontend interfaces. It allows different parts of your site (and external apps) to talk to each other using standard web protocols.
When someone says “REST API is disabled,” they usually mean one of three things:
- Permalink structure is broken (most common)
- Security plugin/firewall is blocking it
- Server configuration (mod_security) is interfering
[IMAGE PLACEHOLDER: Diagram showing WordPress frontend communicating with backend via REST API endpoints]
Method 1: Fix Permalink Structure (The 30-Second Solution)
This fixes 70% of cases. WordPress REST API requires “pretty permalinks” to work.
Step 1: Log into WordPress admin (if you can). Go to Settings → Permalinks.
Step 2: Don’t change anything. Just click “Save Changes” at the bottom.
Step 3: Test the REST API by visiting https://yoursite.com/wp-json/ in your browser. You should see a JSON response with site information, not a 404 error.
Why This Works: Sometimes the .htaccess file gets corrupted or rules aren’t flushed. Saving permalinks regenerates rewrite rules.
If You Can’t Access Admin: Use FTP/cPanel to rename your .htaccess file to .htaccess_backup, then create a new one with this default WordPress code:
apache
Copy
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* – [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ – [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
Method 2: Disable Conflicting Security Plugins
Security plugins are overprotective. They often block REST API endpoints thinking they’re attacks.
Step 1: If you recently installed or updated a security plugin (Wordfence, Sucuri, iThemes Security), that’s likely your culprit.
Step 2: Via FTP or file manager, rename the plugin folder temporarily. Navigate to /wp-content/plugins/ and rename:
- wordfence to wordfence_disabled
- better-wp-security to better-wp-security_disabled
Step 3: Test the REST API endpoint again. If it works, you found the problem.
Step 4: Reactivate the plugin and whitelist REST API:
For Wordfence:
- Go to Wordfence → All Options → Firewall Options
- Set “API Access” to “Allowlisted”
- Or disable “Rate Limiting” temporarily
For iThemes Security:
- Go to Security → Settings → WordPress Tweaks
- Disable “Disable REST API” or set to “Default (Enabled)”
[IMAGE PLACEHOLDER: Screenshot of Wordfence firewall options showing REST API whitelisting]
Method 3: Whitelist in mod_security (Server-Level Fix)
This is the advanced fix for when you don’t have a security plugin, but your host is blocking API requests.
Step 1: Check if mod_security is enabled. Create a PHP file named info.php with:
php
Copy
<?php phpinfo(); ?>
Visit it in your browser and search for “mod_security”. If it’s enabled, proceed.
Step 2: Contact your host to whitelist REST API rules, or if you have access, add this to your .htaccess in the WordPress root:
apache
Copy
<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>
Warning: This disables mod_security entirely for your site. Better approach: ask your host to whitelist specific rule IDs causing the block. Common culprits are rules blocking JSON content types or PUT/DELETE HTTP methods.
For VPS/Users with WHM: Go to ModSecurity Tools → Hits List, find the rule blocking /wp-json/, and disable that specific rule ID.
Method 4: Enable REST API via Code (When Everything Else Fails)
Sometimes themes or custom code disables the REST API. Let’s force it back on.
Step 1: Add this to your theme’s functions.php or a custom plugin:
php
Copy
// Force enable REST API
add_filter(‘rest_authentication_errors’, function($result) {
if (!empty($result)) {
return $result;
}
return true;
});
// Ensure REST API is not disabled
remove_filter(‘rest_authentication_errors’, ‘disable_rest_api’);
Step 2: If you suspect your theme is the issue, temporarily switch to a default theme (Twenty Twenty-Four) by renaming your current theme folder via FTP.
Step 3: Check for custom code in wp-config.php that might be disabling REST API:
php
Copy
// REMOVE these lines if present:
define(‘REST_API_DISABLED’, true);
// or
add_filter(‘rest_enabled’, ‘__return_false’);
Method 5: Fix CORS and Authentication Issues (For Developers)
If you’re building a headless site or mobile app, you might see CORS errors or authentication failures.
Step 1: For CORS issues, add to .htaccess:
apache
Copy
<IfModule mod_headers.c>
Header always set Access-Control-Allow-Origin “*”
Header always set Access-Control-Allow-Methods “POST, GET, OPTIONS, DELETE, PUT”
Header always set Access-Control-Allow-Headers “Content-Type, Authorization”
</IfModule>
Step 2: For authentication issues with Application Passwords (WordPress 5.6+), ensure your server passes HTTP Authorization headers. In .htaccess:
apache
Copy
RewriteEngine on
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) – [E=HTTP_AUTHORIZATION:%1]
Step 3: If using NGINX, add to your config:
nginx
Copy
location ~ ^/wp-json/ {
rewrite ^/wp-json/(.*?)$ /?rest_route=/$1 last;
}
FAQs: Quick Answers
Why is my REST API returning 404 errors?
Usually permalink rewrite rules aren’t working. Flush permalinks (Method 1) or check if your server supports URL rewriting (Apache mod_rewrite or NGINX try_files).
Can I disable REST API for security reasons?
You can, but you’ll break Gutenberg, the WordPress mobile app, and most modern plugins. If you must restrict it, use plugins that limit access by user role rather than disabling completely.
Does this affect WooCommerce?
Absolutely. WooCommerce uses the REST API for admin AJAX, checkout processes, and inventory management. If REST API is blocked, your store stops working properly.
How do I test if REST API is working?
Visit https://yoursite.com/wp-json/wp/v2/posts in your browser. You should see JSON data of your recent posts. If you see 404, 403, or 500 errors, it’s broken.
Will fixing this break my security?
No. The REST API is core WordPress functionality and is secure when properly configured. Blocking it isn’t security—it’s breaking functionality. Use proper authentication and nonces instead.
Conclusion: API Restored, Site Restored
The REST API isn’t optional anymore—it’s essential WordPress infrastructure. Whether it was permalinks, an overzealous security plugin, or server rules, you now have the tools to diagnose and fix any REST API issue.
Quick Checklist:
- [ ] Permalinks flushed and .htaccess correct
- [ ] Security plugins configured to allow API access
- [ ] Server mod_security rules whitelisted
- [ ] No custom code disabling REST API in functions.php or wp-config.php
Modern WordPress depends on this connection working. Keep it flowing, and your site stays modern and functional.
Keep your WordPress healthy. Test your REST API monthly as part of maintenance.
