If your AI/auto-publishing to WordPress "works then randomly stops," it's your firewall — not the tool

Lost a week to this, posting in case it saves someone else the headache.

If you've set up any tool to auto-post to WordPress (an AI writer, Zapier, a custom script) and it "works for a bit then silently stops," you're probably fighting your own security stack, not the tool.

These tools publish by POSTing to your site's REST API (/wp-json/). Cloudflare, Wordfence, Sucuri, and most managed-host WAFs see a non-browser hitting /wp-json/ and either challenge it or 403 it before WordPress even loads — so posts silently fail to go live.

Quick way to tell where it's blocked:

• 403 + an HTML "Just a moment…" page / a cf-mitigated header → it's Cloudflare / your WAF.
• A JSON error like rest_login_required or rest_cannot_create → the request reached WordPress; it's a security plugin or a permissions/application-password issue. (Also: Application Passwords silently break if the site isn't on HTTPS.)

The trap everyone falls into: whitelist the tool's IP or add a WAF exception for /wp-json/. Works for a day, then IPs rotate or a plugin update resets it — back to a dead blog. Whack-a-mole.

What actually fixed it for me: stop pushing into WordPress from outside. Have something that runs inside the site pull the content on a schedule (a small plugin that executes as a normal WordPress request). The firewall never sees an inbound write, so there's nothing to block — it works behind Cloudflare/Sucuri/Wordfence with no whitelisting and no weakening your security.

Happy to go deeper on the diagnosis if anyone's stuck.