WordPress REST API 403 Forbidden: Real Fix That Works

Quick Answer (for the impatient)

Disable your security plugin temporarily. If that fixes it, whitelist the REST API endpoints in that plugin. Also check your .htaccess file for any RewriteRule that blocks wp-json. Had a client last month whose Wordfence firewall blocked the REST API after a false positive update.

Why This Happens

WordPress REST API is the backbone for block editor, mobile apps, and many plugins. When it returns a 403, it means the server is refusing the request. Most of the time, it's not a core WordPress bug. It's something in the middle.

I've seen this on shared hosting, VPS, and even managed WordPress hosts. The top three culprits:

1. Security plugins like Wordfence, Sucuri, iThemes Security, and All In One WP Security. They add firewall rules that block REST requests by default or after an update.
2. Server .htaccess or nginx rules that accidentally block wp-json endpoints. This happens when you copy security rules from another site or a tutorial.
3. Caching plugins or CDNs that cache the 403 response. Once cached, it won't fix until you clear the cache.

The Fix Steps

Here's the step-by-step that works for 9 out of 10 cases. Do them in order.

Step 1: Disable Security Plugins

Go to Plugins > Installed Plugins. Deactivate any security plugin you have. Wordfence, Sucuri, iThemes Security, All In One WP Security — all of them can block REST. After deactivating, test the API again. If it works, you found the problem.

If you have multiple security plugins, deactivate them one at a time. Sometimes two plugins conflict. Had a client using both Wordfence and iThemes Security — they both had REST blocking on by default.

Step 2: Configure the Plugin to Allow REST

If deactivating a security plugin fixes it, don't leave it off. Re-activate it and find the REST API settings.

• Wordfence: Go to Wordfence > All Options > Firewall Options. Look for "Block requests to the WordPress REST API" and set it to "Disabled" or add an exception for your IP.
• iThemes Security: Go to Security > Settings > WordPress REST API. Set it to "Disabled" or "Whitelist" and add the endpoints you need.
• Sucuri: Check Sucuri > Firewall > Access Control. Make sure REST API paths are not blocked.

Step 3: Check .htaccess for Rewrite Rules

Open your site's root .htaccess file via FTP or cPanel File Manager. Look for any lines that block wp-json. You might see something like:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^wp-json - [F,L]
</IfModule>

If you see that, delete those lines. Backup the file first. Also check for any IP block rules. Had a client who copied a security template from a forum that blocked all POST requests to wp-json.

Step 4: Clear All Caches

Even if you fix the rule, a cached 403 can linger. Clear these:

• WordPress cache (if using a caching plugin like WP Rocket, W3 Total Cache, or LiteSpeed Cache)
• Server cache (like Redis or Varnish)
• CDN cache (Cloudflare, StackPath, etc.)
• Browser cache (just in case)

Test the API after each cache clear.

Alternative Fixes If the Main One Fails

Sometimes the above doesn't cut it. Here's what else to try.

Alternative 1: Check for Server-Level Blocking

If you have nginx, look at your server config. Some hosts block /wp-json by default for security. On Apache, check if mod_security is blocking it. You can disable mod_security temporarily for testing (ask your host).

Alternative 2: Use a REST API Troubleshooter Plugin

Install the WP REST API Tester plugin or API Tools from the repo. They show you exactly what's blocking the request. Or use a tool like Postman to send a simple GET request to https://yoursite.com/wp-json/wp/v2/posts. If you get a 403, the issue is server-side. If you get a 200 but no data, it's authentication.

Alternative 3: Reset Permalinks

Go to Settings > Permalinks and hit "Save Changes" without any changes. This resets the rewrite rules. Sometimes a corrupted rewrite rule causes 403. Do this even if your permalinks look fine.

Alternative 4: Check for .htaccess Corruption

Rename your .htaccess file to .htaccess.old via FTP. Then go to Settings > Permalinks again to generate a fresh one. If the API works after that, the old file had a bad rule.

How to Prevent This from Happening Again

Once you fix it, do this so it doesn't come back.

• Keep security plugins updated, but test their updates on a staging site first. They sometimes add new blocking rules.
• Don't copy random .htaccess rules from the internet. I've seen people copy rules meant for WooCommerce that block REST.
• Use a CDN that doesn't cache 403 errors. Cloudflare's "Edge Cache TTL" can cause this. Set it low for API paths.
• Monitor your REST API with a simple cron job. Hit /wp-json/wp/v2/posts?per_page=1 every hour. If you get a 403, you'll know fast.

That's it. The fix is almost always the security plugin. If not, check .htaccess. I've fixed this for at least a dozen clients, and 95% of the time it's one of those two.