An integration or editor can no longer call the REST API.
Probable causes
401 usually indicates that authentication is required or invalid, while a.403 Often corresponds to a recognized but refused access — however a WAF can use these codes differently. Disable all plugins simultaneously causes the signal to lose. Prefer a targeted test and compare headers to identify the layer that blocks.
Verifications.
For the. REST API., first test a public road like./wp-json/ then the exact route that fails, keeping HTTP code, headers and the response body. Compare an anonymous and authenticated query, then examine WordPress, web server, WAF/CDN and security plugin. If the editor works but not an integration, also check the d method, authentication and account capabilities.
Solutions.
Correct only the layer responsible: WordPress, nuncio, Password application, security rule, re-pyly or proxy configuration. Then replay the same query with the same user and check that the routes not covered remain protected. For integration, document the authentication used and avoid, open globally. /wp-json/ to circumvent a refusal.
When to climb?
Cadader if the impact extends, if the data are at risk or if the cause involves irreversible modification.
FAQ — WordPress REST API returns 401 or 403.
What difference between 401 and 403?.
401 usually points to authentication; 403 to a refused authorization, even if some WAF use the codes differently.
Should WordPress security be disabled?.
No. Identify the rule or component responsible and test a minimum exception.
How do I know if the blockage comes from a WAF?.
Compare the body and headers of the response with WAF/CDN logs and the log of the server of origin.