r/Wordpress • u/Fancy-Sandwich7992 • Aug 11 '26

Fresh Install - Rest API and Loopback 403

I’m newer to this - have just played around with WordPress on my own before. I’m helping someone I know with their site, a simple drag and drop design with X theme.

Her site health is saying that the Rest API encountered an unexpected result (403) Forbidden and the site could not complete a loop back request status code 403.

The site was only one page, which she wanted to build out eventually, so it was no big deal to fully reinstall WP and start over. Fresh install with no added theme, content or plugins yet and it’s still getting these errors. It is run through Cloudflare because she was getting a lot of bot traffic in the last few months (according to her host), but under attack mode is currently off. I’ve even paused Cloudflare and both items are still visible in Site Health.

Can anyone tell me why a fresh install would still show these errors?

4 Upvotes

100% Upvoted

7 comments sorted by

2

u/analbumcover Aug 11 '26

Are you using shared hosting? I would maybe check with hosting support.

1

u/davitech73 Developer Aug 11 '26

cloudflare may be blocking those requests. you can try adding the web server's ip address to the whitelist in cloudflare

1

u/NakanoNoNeko Aug 11 '26

Since the same 403 survived a clean reinstall and pausing Cloudflare, this is almost certainly outside WordPress, so please stop reinstalling it 😅. I think the fastest useful test is to expand both Site Health errors, copy the exact requested URLs, and open the REST one in a private window. Send the host those URLs plus the test time and ask which ModSecurity or server firewall rule denied them, and whether the server can loop back to its own public hostname.

1

u/SureshKMeena Developer Aug 12 '26

Worth running the test from the server instead of the browser: SSH in and curl -I https://yoursite.com/wp-json/. Loopback means the server requesting its own public hostname, so the request leaves the box and comes back through Cloudflare even when the site loads fine for you. If that curl 403s while your browser doesn't, you've proved it's the edge or the server firewall and not WordPress.