The block editor and the REST API are the same system: every autosave, revision, and publish button in Gutenberg is a REST request. When the API returns 401 or 403, the symptoms look unrelated — “Updating failed”, the editor refusing to load, page builders’ save buttons spinning. Here is the mapping from error to cause.
401 Unauthorized: the nonce problem
REST cookie authentication depends on a nonce that expires. Symptoms: edits fail after leaving a tab open for hours; publishing works again after refresh.
- Fix: refresh before continuing long editing sessions. If it happens constantly, a plugin is regenerating nonces too aggressively — cache plugins caching admin Nonce responses, or aggressive Heartbeat throttling.
- Never cache anything containing
wp-restnonces. Cache plugins that over-reach into admin context cause exactly this — the cache layer test shows which handle it correctly.
403 Forbidden: someone is blocking the door
- Security plugins: firewalls that treat REST as an attack surface (Wordfence’s block options, iThemes-style XML-RPC/REST toggles). Whitelist the endpoints your editors need; the security plugin comparison maps who blocks what.
- Server rules: mod_security or nginx rules rejecting
/wp-json/patterns. The site’s error log shows the rule hit; the host whitelists. - REST API disabled by hardening plugins: some hardening plugins disable REST for logged-out users only — that is usually safe — others disable it entirely and break the editor for everyone.
The special case: 404 on /wp-json/
Permalinks. After migrations or permalink changes, rewrite rules for REST routes vanish. Fix: re-save Settings → Permalinks, or wp rewrite flush --allow-root. If it persists, the server is missing the catch-all rewrite to WordPress — check the host’s nginx/Apache config.
Diagnose like this
- Visit
/wp-json/directly logged out — a JSON index means routing works; a 403 means server/security blocking. - Log in and hit the specific failing endpoint (the editor’s network tab names it).
- Check
debug.logfor the corresponding PHP error — the critical error guide covers reading it.
Usually a REST API failure: expired nonce (401 — refresh the page) or a firewall blocking /wp-json/ requests (403). The browser network tab shows which request failed and with what status. Stale rewrite rules — common after migrations. Re-save permalinks or run wp rewrite flush. If persistent, the server config lacks the catch-all route to WordPress. Restricting sensitive endpoints from logged-out users is reasonable hardening. Disabling it entirely breaks the block editor and modern plugins — not worth it on content sites. Cookie authentication only applies logged-in. Logged-out 403s point at security plugins or server rules blocking public REST access — check the firewall logs.Why does Gutenberg say 'Updating failed'?
Why is /wp-json/ returning 404?
Should I disable the WordPress REST API?
Why do REST requests fail only for logged-out visitors?
