WordPress REST API blocked by a security plugin (Wordfence, Solid Security, Disable REST API)
Seeing rest_forbidden, rest_cannot_access or "Only authenticated users can access the REST API"? Find what blocks /wp-json/ and let your connector in.
Rather not do this yourself?Book a free setup call and we will connect your site to Claude or ChatGPT with you, live. Pick a time →- Check what /wp-json/ returns when you are logged out
- Look for a plugin that restricts the REST API
- Solid Security (iThemes): check the REST API setting
- Wordfence: check application passwords and the firewall
- Make sure application passwords are switched on
- Rule out a host or Cloudflare firewall
- Check that the Authorization header reaches WordPress
- Test again, then reconnect
Why it happens
Apps that manage WordPress from outside (MCP connectors for Claude and ChatGPT, the mobile app, Zapier, even the block editor) all talk to your site through the REST API at /wp-json/. Security and performance plugins often restrict it to cut down on bots. Some answer every logged-out request with a 401 such as rest_cannot_access or "Only authenticated users can access the REST API". Some hide single routes, like the users list. A firewall rule can also block the request before WordPress sees it, because it looks automated or carries an Authorization header. A connector that logs in with an application password usually passes a "logged-in users only" rule. It fails when the same plugin also switches off application passwords, strips the Authorization header, limits the API to administrators, or when a firewall blocks the call outright. The steps below find which of these you have.
Step by step
Work through these in order. Most people are done by step two.
Check what /wp-json/ returns when you are logged out
Open https://yoursite.com/wp-json/ in a private browser window. A long page of JSON means the REST API is open. A short JSON error such as rest_cannot_access, rest_forbidden or "Only authenticated users can access the REST API" means a plugin restricts it to logged-in users, which a connector with an application password can still pass. An HTML block page, a 403 page or a captcha means a firewall is in the way (see step 6).
Look for a plugin that restricts the REST API
Go to Plugins and look for Disable REST API, Disable WP REST API, WP Hide & Security Enhancer, Perfmatters, Clearfy or a similar hardening plugin. Open its settings and find the REST API option. "Logged-in users only" is fine for a connector. "Administrators only" means the WordPress user you connected with must be an administrator, or the route must be allowed. "Disabled completely" blocks every connector.
Solid Security (iThemes): check the REST API setting
In Security, Settings, Advanced, WordPress Tweaks, find REST API. "Restricted Access" limits what logged-out visitors can read and normally still lets an authenticated connector in. If the connector fails, switch to "Default Access" for a moment and test again. If that fixes it, keep Default Access or allow the routes your connector needs.
Wordfence: check application passwords and the firewall
Wordfence has no single switch that turns the REST API off. Three settings matter. In Login Security, Settings, make sure "Disable WordPress application passwords" is unchecked. In Wordfence, Tools, Live Traffic, look for blocked requests at the time you tried to connect and allowlist them if they are your connector. The option that hides usernames from the REST API only hides the users list from logged-out visitors and does not block a logged-in connector.
Make sure application passwords are switched on
Open Users, Profile and scroll down. If there is no Application Passwords box, or it says they are disabled or not available, fix that first. Without an application password the connector cannot log in, so every "logged-in users only" rule will block it.
Rule out a host or Cloudflare firewall
If /wp-json/ shows an HTML error page, a challenge page or a 403 from your host, the block happens before WordPress. Common sources are Cloudflare WAF rules or Bot Fight Mode, ModSecurity on shared hosting, and managed-host security layers. Add a rule that skips the security check for the /wp-json/ path, or ask your host to allow it.
Check that the Authorization header reaches WordPress
On some Apache and CGI setups the server drops the Authorization header, so WordPress sees no login at all and answers 401 rest_not_logged_in even with a correct application password. The usual fix is one line in .htaccess, above the WordPress block: SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1. Your host can add it for you.
Test again, then reconnect
Repeat step 1, then reconnect the site in your connector. If it now connects but some tools still fail, the plugin is blocking only certain routes; allow those routes or loosen the rule to logged-in users only.
Turn the security plugin off for two minutes and try to connect. If it works, the plugin is the cause and its support team can tell you which rule to relax. If it still fails with the plugin off, the block is at the host or CDN, so send your host the exact error and the time you tried. Then message us with your site address and we will check the connection from our side.
Related questions
01Is it safe to open the WordPress REST API again?
Yes. WordPress itself uses the REST API (the block editor depends on it). Limiting logged-out access is a sensible default, and a connector that logs in with an application password works with that limit in place. What breaks connectors is blocking the API for logged-in users too, or blocking it at the firewall.
02Does Wordfence block the REST API by default?
No. Wordfence can hide the users list from logged-out visitors and its firewall can block single requests, but it has no default setting that turns the whole REST API off. Its option to disable application passwords is the one that most often stops connectors.
03What does rest_cannot_access mean?
It means the request reached WordPress, but a plugin decided this visitor may not use the REST API, usually because the request was not logged in. Check that application passwords are on and that the connector is using one.
04Why does /wp-json/ work in my browser but the connector still fails?
Your browser is logged in with a cookie, so plugin rules let it through. A connector arrives from a server with an application password instead, and firewalls treat that kind of request differently. Test in a private window to see what a logged-out request gets.
05Can I keep the REST API limited to logged-in users?
Yes. That setting is compatible with connectors that authenticate, as long as application passwords are enabled and the Authorization header reaches WordPress.