Recommended Free Tools
A blocked WordPress Ajax request is usually caused by one of five layers: an incorrect admin-ajax.php URL, an unregistered action, a failed nonce or permission check, a security plugin/WAF rule, or a PHP/server failure. Open the browser’s Network panel first. The request’s exact status code and response body show whether it reached WordPress and which layer rejected it. Fix that layer with the narrowest possible change instead of disabling the firewall or REST API.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What a “blocked” WordPress Ajax request actually means
WordPress has two commonly used request systems:
- Admin Ajax: requests go to
/wp-admin/admin-ajax.phpand include anactionvalue that selects a PHP callback. - REST API: requests go to a route under
/wp-json/and use WordPress REST authentication, permissions and route registration.
A browser console message such as “Failed to load resource” or “403 Forbidden” does not identify the blocker. The response may have been generated by WordPress, a security plugin, a CDN or host firewall, the web server, PHP, or an upstream timeout. The response body, headers, initiator and server logs are more useful than the console message alone.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Start with the browser Network panel
Capture one failing request before changing settings. Reproduce the action with developer tools open, then inspect the request in Network. Filter for admin-ajax.php, wp-json, or XHR/Fetch.
- Click the failed request and copy its complete URL. Note whether it is an Admin Ajax or REST request, and whether the scheme, hostname, subdirectory and protocol match the page that initiated it.
- Record the HTTP method, status code, request payload or query string, request headers, cookies and the Initiator. The initiator identifies the script and line that created the call.
- Read the response body. WordPress may return JSON, a nonce error, a capability error, a “0” response, a PHP warning, or an HTML block page. A CDN or WAF often adds its own branded HTML or a request identifier.
- Use the Network panel’s Headers and Timing views to see redirects, cache hits, connection delays and time spent waiting for the server.
- Repeat the request in an incognito window or while logged out if the feature is intended for visitors. A request that works for an administrator but fails for a visitor has a user-context or public-handler problem, not necessarily a firewall problem.
- Save the status, body and timestamp. Match that time against WordPress, PHP, web-server, security-plugin, CDN and hosting-firewall logs.
Do not begin by allowlisting the endpoint. First establish whether the request reached WordPress and whether its payload is valid.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Correct the Ajax URL and action
Pass the site-specific endpoint from PHP
Frontend JavaScript must not guess the site URL. This matters on subdirectory installs, multisite, domain mappings, HTTPS migrations and sites with unusual WordPress or home URLs. WordPress Developer Resources specifies that Ajax requests must be sent to wp-admin/admin-ajax.php and notes that jQuery cannot determine the correct site URL by itself.
Generate the endpoint in PHP and expose it to the script through localized data or an equivalent data object:
<?php
wp_enqueue_script(
'game-tools',
get_template_directory_uri() . '/assets/game-tools.js',
array(),
'1.0.0',
true
);
wp_localize_script(
'game-tools',
'gameTools',
array(
'ajaxUrl' => admin_url('admin-ajax.php'),
'nonce' => wp_create_nonce('game_tools'),
)
);
Then use the supplied value instead of a hardcoded domain:
fetch(gameTools.ajaxUrl, {
method: 'POST',
headers: { 'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8' },
body: new URLSearchParams({
action: 'save_game_settings',
_ajax_nonce: gameTools.nonce,
setting: 'compact'
})
});
If the Network panel shows a request to the wrong host, an old HTTP address, a missing subdirectory, or a front-end route instead of admin-ajax.php, fix the generated data or the script version before changing security rules.
Make the action match a registered callback
The value of action is not arbitrary. For a request from a logged-in user, register wp_ajax_{action}. If logged-out visitors are supported, also register wp_ajax_nopriv_{action}. The suffix must match the submitted action exactly, including spelling and underscores.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
<?php
add_action('wp_ajax_save_game_settings', 'save_game_settings');
add_action('wp_ajax_nopriv_save_game_settings', 'save_game_settings');
function save_game_settings() {
check_ajax_referer('game_tools', '_ajax_nonce');
if (!current_user_can('edit_posts')) {
wp_send_json_error(array('message' => 'Not permitted'), 403);
}
$setting = isset($_POST['setting'])
? sanitize_key(wp_unslash($_POST['setting']))
: '';
if ($setting !== 'compact') {
wp_send_json_error(array('message' => 'Invalid setting'), 400);
}
wp_send_json_success(array('setting' => $setting));
}
A missing or misspelled callback commonly produces an empty response or a zero-style response rather than the JSON your JavaScript expects. Inspect that response before assuming a WAF blocked the request.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Repair nonce and authorization failures
Admin Ajax nonce checks
A nonce proves that a request was generated in an expected WordPress session; it is not a login mechanism or a permission grant. A stale, missing or incorrectly named nonce normally ends an Admin Ajax request with HTTP 403.
- Send the field name expected by the handler, commonly
_ajax_nonce(some handlers use_wpnonceor a custom name). - Pass the same action string to
wp_create_nonce()andcheck_ajax_referer(). - Regenerate the page or clear stale cached HTML after changing a nonce action. Full-page caches can serve a nonce created for an earlier session or deployment.
- Check the response body for a nonce failure before allowlisting the request.
Nonce verification and authorization are separate checks. After verifying the nonce, protect sensitive operations with current_user_can(), then validate and sanitize every input. WordPress explicitly warns that nonces must not be relied on for authentication, authorization or access control.
REST API authentication
For a REST request made from an authenticated WordPress page, send the nonce as the X-WP-Nonce header or as the _wpnonce parameter, according to the route and client implementation:
fetch('/wp-json/my-plugin/v1/loadout', {
headers: {
'X-WP-Nonce': window.wpApiSettings.nonce,
'Accept': 'application/json'
},
credentials: 'same-origin'
});
A REST route must also be registered, its permission callback must allow the current user, and the browser must send the appropriate cookies when cookie authentication is used. A valid nonce cannot compensate for a missing route, an insufficient capability, or a request sent to the wrong origin.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Use the status code to narrow the blocking layer
| Status or symptom | Likely causes | What to check next |
|---|---|---|
| 401 | Missing or invalid authentication; an API route requiring a logged-in user | Cookies, credentials, login state, REST nonce and the route’s permission callback |
| 403 | Nonce failure, capability denial, security plugin, CDN/WAF, host firewall or server rule | Response body and headers, nonce field/action, user capability, and firewall events at the request time |
| 404 | Wrong endpoint, missing rewrite, unregistered REST route or an incorrect site subdirectory | Generated URL, permalink/rewrite configuration and REST route registration |
200 with 0 or empty output |
No matching Ajax callback, early termination, or handler output that is not JSON | Submitted action, both hook registrations, PHP notices and the callback’s response code |
| 500 | PHP fatal error, plugin/theme conflict, invalid data or database failure | PHP error log, WordPress debug log and the server log; reproduce with nonessential plugins disabled only in a controlled environment |
| Timeout or 502/504 | Slow PHP, expensive database work, upstream limits, overloaded admin-ajax.php or a proxy timeout |
Network timing, PHP-FPM/web-server limits, query performance and hosting resource graphs |
| HTML challenge or branded block page | CDN, bot protection, ModSecurity, host WAF or security plugin | The corresponding security event log and its rule identifier |
A 403 alone is not proof that WordPress generated the denial. A WAF can reject a request before PHP runs, while a nonce check can return the same status from inside WordPress.
Check security plugins and WordPress firewalls
Security controls may block the endpoint itself or flag a parameter, payload pattern, user agent, IP address or request rate. Review the event log rather than turning protection off globally.
Wordfence firewall workflow
Wordfence documents cases in which its firewall blocked /wp-admin/admin-ajax.php. Its recommended diagnostic workflow is:
- Switch the firewall to Learning Mode.
- Perform the exact action that failed, using the same account and browser context.
- Inspect Live Traffic and the firewall event to confirm the matched rule and request parameter.
- Return the firewall to Enabled and Protecting after the test.
- If an exception is genuinely required, allowlist the specific legitimate parameter, action or request pattern shown by the event, not the entire administrative directory.
Learning Mode is a temporary diagnostic state, not a permanent fix. If no event appears while the request fails, the block is probably occurring at another layer.
Cloudflare, host WAF, ModSecurity, fail2ban and server rules
For Cloudflare or a host-managed WAF, search the security events by timestamp, path, method, client IP and Ray or request identifier. For ModSecurity, inspect the audit log and rule ID. For fail2ban, check whether the client IP was banned. For Apache or NGINX, review .htaccess and server configuration for rules matching admin-ajax.php, query parameters, referrers or user agents.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Allowlist only what the legitimate request needs:
- the exact path, such as
/wp-admin/admin-ajax.phpor one REST route; - the required HTTP method;
- the specific action or parameter that triggered a false positive;
- the authenticated context, trusted role or narrowly defined source where the firewall supports it.
Avoid a blanket exception for /wp-admin/, an unrestricted IP allowlist, or a rule that permits every request to the endpoint. Keep logging enabled and document how to remove the exception.
Do not disable the REST API to hide a failure
WordPress states that disabling the REST API breaks Admin functionality that depends on it. If the dashboard, block editor, media picker or a plugin stops working after an API restriction, restore the API and repair the actual issue:
- send
X-WP-Nonceor_wpnoncecorrectly; - preserve authentication cookies and use the correct origin;
- register the route and return an appropriate permission callback;
- correct a rewrite, namespace or route path;
- adjust the WAF rule for the specific route or request parameter.
Cross-origin requests add another failure mode. A browser may report a CORS error when the server omits the required Access-Control-Allow-Origin header, allows credentials incorrectly, or rejects the preflight OPTIONS request. CORS is enforced by the browser; it is not fixed by adding a nonce to an otherwise unauthorized request. Keep authenticated API calls same-origin when possible. If a separate trusted origin is required, configure an exact origin and the necessary methods and headers rather than using a wildcard with credentials.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallInvestigate PHP, database and server failures
When the Network panel shows 500, 502, 504 or a timeout, security allowlisting is unlikely to solve the problem. Check:
- the PHP error log and WordPress debug log for a fatal error, memory exhaustion or undefined function;
- the web-server and PHP-FPM logs for worker exhaustion and upstream resets;
- database logs and slow-query information if the callback performs queries;
- request and execution limits such as PHP memory, maximum execution time and proxy timeout;
- recent theme, plugin, PHP-version or deployment changes.
Use a staging site or a maintenance window when disabling plugins or changing PHP settings. If the callback is slow, profile its database work and return a small JSON response; increasing a proxy timeout can mask an inefficient handler without fixing it.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
A controlled repair sequence
Follow this order so each test answers one question:
- Capture the failure: save URL, method, status, response body, initiator and timestamp from Network.
- Classify the endpoint: determine whether it is
admin-ajax.phpor a REST route and whether the test is logged in. - Fix routing: generate the endpoint with
admin_url('admin-ajax.php'); verify the REST path, scheme, host and subdirectory. - Verify the payload: confirm the action, method, required fields, nonce field and content type.
- Verify server hooks: check the matching
wp_ajax_and, when needed,wp_ajax_nopriv_registrations or REST route registration. - Verify security in code: run the expected nonce check, capability check and input validation; do not treat a nonce as authorization.
- Match logs: look for the same request in WordPress/PHP logs and each security layer’s event log.
- Make one narrow change: adjust the handler, refresh the nonce, or allowlist the precise false-positive rule.
- Retest both contexts: test logged in and logged out when both are supported, plus the original browser and a clean session.
- Restore protection: leave firewalls in protecting mode, remove temporary bypasses, and re-enable caches and optimization one at a time.
Choose the least risky fix
| Fix option | Scope | Observability | Risk and reversibility |
|---|---|---|---|
| Correct URL, action or callback | Single feature | Clear in Network and PHP logs | Lowest risk; easily reverted |
| Refresh or correctly verify nonce | Single request or session | Visible in response and application logs | Low risk; preserves security checks |
| Add capability and input validation | Handler’s authorized users and fields | Application logs can show denials | Low risk; required for sensitive actions |
| Allowlist one WAF rule, action or parameter | Narrow request pattern | Firewall event remains attributable | Moderate risk; document and review periodically |
Allow the whole endpoint or /wp-admin/ |
Broad | Weak attribution | High exposure; avoid |
| Disable the firewall or REST API | Site-wide | Removes useful protection | Highest risk; not a repair |
Prefer a logged, reversible exception that covers one legitimate request. If the request can be corrected in code, do that instead of changing perimeter security.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Retest after caching and optimization changes
Minification, script concatenation, delayed JavaScript, page caching and CDN caching can preserve an old endpoint, nonce or payload. Temporarily bypass those layers while testing. Once the request succeeds, re-enable each feature separately and retest. The first re-enabled component that reproduces the failure is the likely source.
Test a matrix appropriate to the feature:
- administrator, ordinary authenticated user and logged-out visitor;
- desktop and mobile browser if different scripts are served;
- fresh page load and a page served from cache;
- HTTP-to-HTTPS redirect path and the final HTTPS request;
- the original action and malformed or unauthorized input, which should be rejected safely.
Successful testing means more than receiving HTTP 200: confirm the response is valid JSON with the expected shape, unauthorized users remain denied, and the firewall still records and protects unrelated requests.
Prevent future Ajax blocks
- Generate the Admin Ajax URL in PHP instead of hardcoding a domain.
- Keep the JavaScript action name, PHP hook suffix and nonce action in one documented contract.
- Send the nonce in the field or header the handler actually verifies.
- Use capability checks, validation and sanitization independently of nonce verification.
- Return explicit JSON status codes and messages rather than accidental PHP output or a bare zero.
- Keep REST enabled unless there is a documented, tested alternative for every dependent feature.
- Monitor WAF and security-plugin events and record any narrow exceptions with an owner and review date.
- Retest Ajax and REST calls after domain, HTTPS, cache, plugin, theme, PHP and firewall changes.
Frequently asked questions
Why does an Ajax request work for administrators but not visitors?
The public request may lack the wp_ajax_nopriv_{action} hook, a required cookie, or permission to use the operation. Register a separate public callback only when the feature is intended for visitors, and apply validation and rate controls appropriate to an unauthenticated endpoint.
Is a 403 always caused by a security plugin?
No. A failed nonce or capability check inside WordPress, a CDN or host WAF, a server rule, and an application-level permission callback can all return 403. The response body and matching logs identify which layer acted.
Should I add admin-ajax.php to a global allowlist?
No. Broadly allowing the endpoint can expose every registered action to unwanted traffic. Allow only the method, action, parameter or authenticated context required by the legitimate feature, and keep the exception logged.
Why does the REST API appear blocked after a plugin update?
The update may have changed a route, permission callback, nonce handling or request header, while a cache may still serve old JavaScript. Compare the generated route and headers with the current code, inspect the REST response and firewall event, and keep the API enabled while correcting the mismatch.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
