# WordPress REST API returns 403 Forbidden on authenticated request **URL:** \ **Category:** Hosting Support\ **Created:** [October 14, 2026, 3:45pm UTC](https://forum.infinityfree.com/t/wordpress-rest-api-returns-403-forbidden-on-authenticated-request/121338 "2026-10-14T15:45:00Z")\ **Posts on this page:** 1\ **Showing post:** 3
**Author:** ![Lemni](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/lemni/32/68303_2.png) [@Lemni](https://forum.infinityfree.com/u/Lemni)\ **Post date:** [October 14, 2026, 3:45pm UTC](https://forum.infinityfree.com/t/wordpress-rest-api-returns-403-forbidden-on-authenticated-request/121338/3 "2026-10-14T15:45:15Z")
_Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look._ This is InfinityFree’s browser security system, not a ModSecurity or firewall rule on your account. It can’t be turned off or allowed per endpoint on free hosting. The system requires JavaScript and cookies, which plugins, scripts and WordPress’s own self-checks can’t provide. Programmatic requests to your site, including REST API endpoints, usually get a “403 Forbidden” back. This article covers it: > [@Why isn't API access working on my website?](https://forum.infinityfree.com/docs?topic=115198): > > If you’re trying to use APIs on your InfinityFree website and they’re not working, this is due to our browser security system that’s required on all free hosting accounts. What’s happening? InfinityFree uses a security system that requires JavaScript and cookies to access websites. APIs and automated tools typically can’t execute JavaScript or store cookies, so they get blocked by the security system. When API clients try to connect, they usually receive a “403 Forbidden” error or a HTML respo… For the Site Health message, “The REST API encountered an unexpected result” is a known warning on InfinityFree. It appears because WordPress can’t call its own site through the security system. It doesn’t mean the API is broken for real visitors. This article lists it: > [@WordPress Site Health warnings on free hosting](https://forum.infinityfree.com/docs?topic=78910): > > WordPress includes a Site Health tool that checks your website’s configuration and reports potential issues. You can find it under Tools → Site Health in your WordPress admin area, or it may appear through plugins like Health Check & Troubleshooting. Don’t worry if you see multiple warnings when running these checks on InfinityFree. Most warnings are completely normal and expected on free hosting. Your website works perfectly fine for visitors despite these alerts. The warnings appear because f… So the Site Health warning can be ignored. But your MCP plugin connects from outside as an automated client, so it will most likely be blocked the same way. I don’t think it can work on free hosting. The article’s options are [premium hosting](https://www.infinityfree.com/premium/), which doesn’t have this restriction, or a different setup that doesn’t need inbound API calls. I haven’t verified how your specific plugin connects, so that part is an inference from the article. More detail on how the security system works is here: > [@Browser Security System - Features and Limitations](https://forum.infinityfree.com/t/browser-security-system-features-and-limitations/49353): > > InfinityFree uses a security system on all free hosting accounts to ensure your website is accessed by real web browsers, not bots or automated scripts. While this protects your site from malicious traffic, it can affect certain types of access. How the security system works The system checks that visitors can execute JavaScript and accept cookies: features that all modern web browsers support. This verification happens automatically and most website visitors will never notice it. You may occa… --- _[View the full topic](https://forum.infinityfree.com/t/wordpress-rest-api-returns-403-forbidden-on-authenticated-request/121338)._