WordPress connection failing? Fix a disabled REST API, Wordfence blocks, missing Application Passwords, and 401/403/404 errors on /wp-json fast.
You created an Application Password, pasted your site URL, and hit connect. Instead of a green checkmark, you got an error: "REST API disabled," "401 Unauthorized," "403 Forbidden," or "cannot connect to your site." This is the single most common reason a WordPress connection fails, and it is almost never a problem with the tool you are connecting. It is a setting on your own WordPress site that quietly blocks the connection.
These are the exact errors people hit when they connect PostSprout to WordPress so it can auto-publish articles. The good news: every one of them has a clear fix, and none of them need a developer. This guide walks through each failure as a symptom, a cause, and a fix, so you can find yours fast and get connected.
Before you change anything, test the REST API in your browser. It takes ten seconds and tells you where the problem is.
Open a new browser tab and go to this address, swapping in your own domain:
What you see tells you a lot:
WordPress also has a built-in checker. Go to Tools > Site Health > Info > REST API in your dashboard. If it reports an error there, WordPress itself cannot reach its own API, which points to a plugin or server block.
The REST API is the door any modern tool uses to talk to WordPress. When a connection fails, one of a handful of things is blocking that door. Here is the short map before we fix each one.
| What you see | Most likely cause | Where to fix it |
|---|---|---|
| "REST API disabled" at /wp-json | Security plugin or a "disable REST API" plugin | Plugin settings, allowlist /wp-json |
| No "Application Passwords" section in your profile | App Passwords turned off, or site on HTTP | HTTPS, security plugin, or a filter |
| 401 Unauthorized with a correct password | Host strips the Authorization header | .htaccess fix |
| 403 Forbidden | Firewall rule or security plugin | Firewall allowlist / learning mode |
| 404 Not Found at /wp-json | Broken permalink rewrite rules | Resave permalinks |
This is the number one cause. Security plugins ship rules that can turn off the REST API or block anyone who is not logged in, and a routine update can switch these on without warning.
Wordfence does not block the REST API by default, but its firewall can flag a connection as suspicious and stop it. Two things to check:
Solid Security has a REST API setting that can restrict access. Go to Security > Settings > Advanced > WordPress Tweaks, find the REST API section, and set it to Default Access. The "Restricted" setting is a common source of 401 errors on otherwise healthy sites.
Plugins with names like "Disable REST API," All In One WP Security, or some performance plugins have a single switch that turns the API off for anyone not logged in. If you installed one to harden your site, open its settings and either turn the block off or add /wp-json to its allowlist. If you are not sure which plugin is responsible, the fastest test is below.
Temporarily deactivate your security and optimization plugins one at a time, re-test yoursite.com/wp-json after each, and watch for the moment the API comes back. That tells you the exact plugin. Then re-enable it and adjust its setting rather than leaving it off.
To connect a tool, you create an Application Password under Users > Profile (scroll to the bottom). If that section is missing, WordPress has switched the feature off. Application Passwords are the safe, modern way to connect: they are a separate credential you can revoke any time without changing your real login.
Common reasons the section disappears:
WordPress silently disables Application Passwords on any site served over plain HTTP. This is on purpose. An Application Password travels in the request header, and on unencrypted HTTP anyone on the same network could read it. So WordPress checks for HTTPS first, and if it is not there, the feature is simply off, with no error to explain why.
How to fix it:
One note for developers only: WordPress does allow Application Passwords over HTTP on a true local environment (localhost). For any live site, HTTPS is the real fix, and it is worth having anyway.
This one is sneaky. You copied the Application Password exactly, HTTPS is on, the API responds at /wp-json, and you still get 401 Unauthorized. The usual cause is that your hosting server is stripping the Authorization header before it reaches WordPress.
WordPress reads your Application Password from the Authorization header on each request. Some Apache and LiteSpeed setups drop that header on the way in, so WordPress never sees your credentials and rejects the request as if the password were wrong.
The fix is to tell your server to pass the header through. Edit the .htaccess file in your WordPress root folder (or ask your host to). Add one of these, above the # BEGIN WordPress line:
The simplest option, which works on most modern hosts:
If that does not work, remove it and try the rewrite version instead:
Save the file and test your connection again. If you are on managed WordPress hosting where you cannot edit .htaccess, open a support ticket and ask them to "pass the Authorization header through to PHP for REST API requests." They will know exactly what you mean. Some hosts strip the header at a level you cannot reach from .htaccess, so their support is the only path.
A 403 Forbidden is not the same as a disabled API. It means something actively refused the request. The API exists, but a gatekeeper said no. The gatekeeper is almost always a firewall: your security plugin, a web application firewall at your host, or a service like Cloudflare sitting in front of your site.
Work through these in order:
The pattern is always the same: find the layer that said no, then allowlist the API rather than turning the whole protection off.
A 404 "Not Found" at /wp-json means the API route does not exist as far as your server is concerned. This is almost always a permalink problem, not a security block.
The REST API rides on the same rewrite rules that make your post URLs pretty. If those rules are stale or your permalinks are set to "Plain," the /wp-json route never gets registered.
The fix takes two clicks:
Re-test yoursite.com/wp-json. If it still 404s, your .htaccess may be corrupted. On Apache or LiteSpeed, rename .htaccess to .htaccess-old using your host's file manager, then save permalinks again to generate a clean file. Also confirm mod_rewrite is enabled, which your host can check.
If you are setting this up from scratch rather than debugging, doing it in the right order avoids every error above. Our step-by-step walkthrough on how to connect WordPress with the REST API and Application Passwords covers the whole flow, and if you are still choosing where your blog lives, how to set up a blog on WordPress gets the foundation right first.
Work down this list in order. Most connections are fixed by step three.
These are the exact checks PostSprout runs into when it connects to a store's WordPress site to auto-publish daily SEO articles. Once the connection is clean, PostSprout writes and publishes to your blog on its own, so you never have to touch the REST API again. If you want hands-off publishing to WordPress or Shopify, start with PostSprout and let it handle the posting while you run your store.
Visit yoursite.com/wp-json in your browser. If you see a wall of JSON text with your site name and a list of routes, the API is on. If you see a 'REST API disabled' message or a 404, it is blocked, and the cause is usually a security plugin or a broken permalink rule.
The most common reason is that your site runs on plain HTTP. WordPress disables Application Passwords on any non-HTTPS site for security. A security plugin, a conflicting Basic Auth layer, or a code snippet can also turn the feature off. Enable HTTPS and check your security plugin settings to bring the section back.
An Application Password travels in the request header, and on unencrypted HTTP anyone on the same network could read it. WordPress checks for HTTPS first and switches the feature off if it is missing, with no error message. Installing an SSL certificate and updating your site URLs to https:// fixes it.
Your hosting server is likely stripping the Authorization header before it reaches WordPress, so WordPress never sees your credentials. Add 'CGIPassAuth On' to your .htaccess file, or ask your host to pass the Authorization header through to PHP for REST API requests.
Wordfence does not block the REST API by default, but its firewall can flag a connection and stop it, and an update can enable a 'Disable WP API JSON' option. Put the firewall in Learning Mode, run your connection, then allowlist the blocked request in Live Traffic before switching protection back on.
A 404 means the API route is not registered, which is a permalink problem. Go to Settings > Permalinks, set the structure to anything other than Plain, and click Save Changes. This rebuilds the rewrite rules and re-registers the API route. If it persists, regenerate a clean .htaccess file.
The playbook
The playbook first, then a few short emails to help you publish your first great article, then just the occasional update. No spam, and you can unsubscribe anytime.