The latest articles on DEV Community by abhrodip paul (@abhrodip_paul_7b1c882d02c). https://dev.to/abhrodip_paul_7b1c882d02c https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4133886%2F8b9c238f-4cc1-431b-9a20-dbfc582efb88.png https://dev.to/abhrodip_paul_7b1c882d02c en abhrodip paul Sun, 20 Sep 2026 08:53:15 +0000 https://dev.to/abhrodip_paul_7b1c882d02c/if-your-aiauto-publishing-to-wordpress-works-then-randomly-stops-its-your-firewall-not-the-2bhi https://dev.to/abhrodip_paul_7b1c882d02c/if-your-aiauto-publishing-to-wordpress-works-then-randomly-stops-its-your-firewall-not-the-2bhi <p>Lost a week to this, posting in case it saves someone else the headache.</p> <p>If you've set up any tool to auto-post to WordPress (an AI writer, Zapier, a custom script) and it "works for a bit then silently stops," you're probably fighting your own security stack, not the tool.</p> <p>These tools publish by POSTing to your site's REST API (<code>/wp-json/</code>). Cloudflare, Wordfence, Sucuri, and most managed-host WAFs see a non-browser hitting <code>/wp-json/</code> and either challenge it or <code>403</code> it before WordPress even loads — so posts silently fail to go live.</p> <p><strong>Quick way to tell where it's blocked:</strong></p> <ul> <li> <strong>403 + an HTML "Just a moment…" page / a <code>cf-mitigated</code> header</strong> → it's Cloudflare / your WAF.</li> <li> <strong>A JSON error like <code>rest_login_required</code> or <code>rest_cannot_create</code></strong> → the request reached WordPress; it's a security plugin or a permissions/application-password issue. (Also: Application Passwords silently break if the site isn't on HTTPS.)</li> </ul> <p>The trap everyone falls into: whitelist the tool's IP or add a WAF exception for <code>/wp-json/</code>. Works for a day, then IPs rotate or a plugin update resets it — back to a dead blog. Whack-a-mole.</p> <p><strong>What actually fixed it for me:</strong> stop pushing <em>into</em> WordPress from outside. Have something that runs <em>inside</em> the site pull the content on a schedule (a small plugin that executes as a normal WordPress request). The firewall never sees an inbound write, so there's nothing to block — it works behind Cloudflare/Sucuri/Wordfence with no whitelisting and no weakening your security.</p> <p>Happy to go deeper on the diagnosis if anyone's stuck.</p> wordpress