6 Ways to Fix WordPress REST API Errors

If your WordPress site suddenly returns blank pages, JSON errors in the block editor, or a cryptic restcookieinvalidnonce message in the browser console, you are losing visitors and, potentially, revenue. Many site owners panic and reinstall WordPress or hire a developer, wasting hours and money. The most common cause is a misconfigured permalink structure or a security plugin blocking REST API requests, and the quickest fix is resetting your permalinks — a 30-second operation that resolves roughly 40% of all REST API issues.

Before you start any of the fixes below, back up your site and database. Use a plugin like UpdraftPlus or your hosting control panel to create a full backup. The REST API is the backbone of the block editor, headless WordPress setups, and many plugins; breaking it further without a safety net is a risk you do not need to take.

Common causes of WordPress REST API errors

Permalink structure corruption — the API endpoint routing breaks.
Security plugin interference — Wordfence, Sucuri, or iThemes Security blocks REST routes.
HTTPS / SSL mismatch — the site URL in the database does not match the actual protocol.
Plugin or theme conflict — a poorly coded plugin overrides REST callbacks.
Server configuration — modrewrite disabled, or .htaccess rules are missing.
Blocking external requests — WordPress cannot communicate with its own API.
Outdated WordPress core — missing REST API fixes from recent versions.
REST API disabled by code — a custom function or mu-plugin disables the endpoint.

How to fix WordPress REST API errors: 8 proven methods

1. Reset your permalinks

Go to Settings > Permalinks in your WordPress admin dashboard. Without changing anything, click Save Changes. This flushes the rewrite rules and regenerates the .htaccess file for the REST API routes. Test the API by visiting https://yoursite.com/wp-json/wp/v2/posts in a browser. If you see a JSON response, the fix worked.

2. Check and update your site URL

An HTTPS mismatch is a frequent culprit. Go to Settings > General and verify that both WordPress Address (URL) and Site Address (URL) use the same protocol — either both http:// or both https://. If they differ, update them and save. If you cannot access the admin, add this to wp-config.php just before the / That's all, stop editing! / line:

define('WPHOME','https://yoursite.com');
define('WPSITEURL','https://yoursite.com');

3. Deactivate all plugins and switch to a default theme

A plugin or theme conflict is the second most common cause. From the admin panel, go to Plugins > Installed Plugins, select all plugins, and choose Deactivate from the bulk actions dropdown. Then go to Appearance > Themes and activate a default WordPress theme like Twenty Twenty-Four. Check the REST API again. If it works, reactivate plugins one by one until you find the offender.

4. Adjust security plugin settings

Security plugins often block REST API access to prevent brute-force attacks. In Wordfence, go to Wordfence > All Options > General Firewall Rules and ensure Block requests to the REST API except for authenticated users is disabled. In iThemes Security, navigate to Security > Settings > Tweaks and turn off Disable XML-RPC (which also affects REST). Save changes and test the API.

5. Verify .htaccess and modrewrite

If permalink reset did not work, your server may have modrewrite disabled. Connect via FTP or your hosting file manager and open the .htaccess file in your WordPress root directory. Ensure it contains the default WordPress rules:

# BEGIN WordPress
<IfModule modrewrite.c>
RewriteEngine On
RewriteRule . - [E=HTTPAUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUESTFILENAME} !-f
RewriteCond %{REQUESTFILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

If the file is missing, create a new one with the above content and upload it. Contact your hosting provider if modrewrite is not enabled.

6. Increase memory limit and PHP execution time

Large REST API responses can time out if PHP memory is low. Add these lines to wp-config.php above the / That's all */ comment:

define('WPMEMORYLIMIT', '256M');
define('WPMAXMEMORYLIMIT', '512M');
settimelimit(300);

Save the file and reload the API endpoint. If the error was a 500 Internal Server Error or a blank page, this often resolves it.

7. Enable debugging and check the error log

Turn on WordPress debugging to see the exact PHP error. Add to wp-config.php:

define('WPDEBUG', true);
define('WPDEBUGLOG', true);
define('WPDEBUGDISPLAY', false);

Visit the REST API endpoint again, then check the wp-content/debug.log file. Common errors include headers already sent (caused by whitespace in plugin files) or call to undefined function (plugin conflict). Fix the specific line mentioned in the log.

8. Check for REST API disabling code

Some developers add code to disable the REST API for security. Look in your theme's functions.php or any mu-plugins folder for code like:

addfilter('rest_enabled', '__returnfalse');
addfilter('restjsonpenabled', '__returnfalse');
removeaction('init', 'restapiinit');

If you find it, comment out or remove those lines. Then test the API again.

How to prevent REST API errors in the future

REST API issues often recur after plugin updates or server migrations. To prevent them, keep WordPress core, themes, and plugins updated. Use a staging environment to test updates before applying them to your live site. Monitor your error log weekly — automated tools like Query Monitor can alert you to REST-related warnings before they break the front end.

Consider using a managed WordPress host that automatically handles server-level configurations like modrewrite and PHP memory limits. If you manage your own server, set up regular cron jobs to flush rewrite rules and verify the site URL matches the database value.

Frequently asked questions

Why does the WordPress REST API return a 404 error?

A 404 error from the REST API usually means your permalink structure is broken or modrewrite is disabled. Reset your permalinks first. If that fails, verify your .htaccess file contains the default WordPress rules and that your server has modrewrite enabled.

How do I test if the REST API is working?

Visit https://yoursite.com/wp-json/wp/v2/posts in a browser. A working REST API returns a JSON object with post data. If you see a blank page, an XML error, or a 403/404 status, one of the fixes above is needed.

Can a security plugin cause REST API errors?

Yes, security plugins like Wordfence, Sucuri, and iThemes Security can block REST API access by default. Check their firewall or tweaks settings for options related to the REST API and disable them temporarily to test.

What is the `rest``cookieinvalidnonce` error?

This error occurs when the nonce (security token) for REST requests is invalid or expired. It often happens after a user logs out or the session expires. Clearing your browser cache and cookies, or regenerating nonces by deactivating and reactivating plugins, usually resolves it.

Do I need to modify the database to fix REST API errors?

Rarely. Database modifications are only necessary if the site URL in the wpoptions table is corrupted — for example, after moving a site from HTTP to HTTPS without updating the database. In that case, use a plugin like Better Search Replace to update the URL across all tables.

Final thoughts

Most WordPress REST API errors are caused by simple misconfigurations — a permalink reset or a plugin deactivation fixes the majority of cases. By working through the methods above from easiest to most advanced, you can restore your site's functionality without hiring a developer. Once your site is healthy again, tools like nativeWP help you publish SEO-optimized content on autopilot, so you spend less time troubleshooting and more time growing your site.