Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.
Yes, the security system is blocking your Codex CLI. It blocks authenticated requests too, and on the free plan there’s no supported way around it.
InfinityFree puts a browser check on all free hosting accounts. It needs the visitor to run JavaScript and accept cookies. That’s the /aes.js script, the __test cookie and the ?i=1 redirect you saw. Codex CLI can’t do either, so it gets the HTML challenge page instead of an MCP response. The check runs before the request reaches WordPress, so your Application Password never gets used. Having valid credentials doesn’t change anything.
This article lists REST APIs and similar automated access as affected:
The security system can’t be turned off on free hosting, and there’s no allowlist for specific endpoints. The guide to the system says so directly:
The options the articles give are:
- Move to premium hosting, which doesn’t have this restriction, so APIs work normally.
- Host the API somewhere else.
Your Codex CLI is making inbound requests to your site, and those are what get blocked. Outbound requests from your site to other services still work.