← WordPress setup guides

WordPress REST API is blocked

42flows talks to your WordPress site through the REST API — the modern, official WordPress interface at /wp-json/. If connection fails with errors like 403 Forbidden, 401 Unauthorized, or "Site not reachable," something is blocking access.

Test the REST API yourself

From any terminal, run:

curl https://your-site.com/wp-json/

Expected: a JSON response starting with {"name":"Your Site Name"....

If you get 403 or a security challenge page: something between your site and the public internet is blocking the REST API.

Common culprits

Cloudflare

  • Go to Cloudflare → Security → WAF.
  • Look for rules that block /wp-json/* or match "REST API" in managed rules.
  • Add a Page Rule or Configuration Rule to allow /wp-json/* for 42flows's IPs (contact us for the current list).

Wordfence

  • Wordfence → Firewall → All Firewall Options.
  • Look for "Block access to REST API" — disable it.
  • Under Rate Limiting, make sure the REST API isn't rate-limited aggressively.

iThemes Security (Solid Security)

  • Security → Settings → WordPress Tweaks.
  • Find "REST API" — change from Restricted to Default Access.

All In One Security (AIOS)

  • WP Security → Firewall → Basic Firewall Rules.
  • Uncheck "Disable the WordPress REST API for unauthorized users" if enabled.

Your hosting provider

Some managed WordPress hosts (Kinsta, WP Engine, SiteGround's "Dynamic Cache Bypass") block or heavily cache the REST API by default. Contact support and ask them to whitelist REST API access for authenticated requests.

Still blocked after fixing the above

If curl https://your-site.com/wp-json/ still fails:

  1. Try from a different network — your own IP might be blocklisted by accident.
  2. Check your .htaccess file for RewriteRule lines blocking /wp-json/.
  3. Disable all security plugins temporarily to isolate the culprit, re-enable one at a time.

Once the REST API responds publicly, 42flows can connect. We only make authenticated requests, so exposing /wp-json/ to the public doesn't let anyone write to your site — they'd still need an Application Password.