WordPress REST API returns HTTP 200 but external services receive non-JSON

Hosting Support
1

Website URL

https://starriehallow.ink

Error Message

Hello,

I’m using InfinityFree free hosting for my WordPress website, https://starriehallow.ink.

I’m trying to connect WPVibe so an AI assistant can inspect and help maintain my WordPress website.

The WordPress REST API works normally in my phone’s browser, on both mobile data and Wi-Fi:

Both return valid JSON.

However, WPVibe’s external connection check reports:

  • WordPress REST API: HTTP 200, but the response did not identify WordPress REST.
  • WPVibe plugin endpoint: HTTP 200, but the response did not identify the WPVibe plugin.
  • WordPress authorization endpoint: Could not verify.

Is InfinityFree’s browser verification or another hosting-level security mechanism returning HTML instead of JSON to external automated requests?

Is there a supported way to allow WPVibe to connect to the WordPress REST API on free hosting, including authenticated requests?

I would appreciate clarification on whether this is possible without upgrading or migrating.

Thank you

Other Information

WPVibe public endpoint check: NOT VERIFIED.1

WordPress REST API (direct): HTTP 200, but the response did not identify WordPress REST.

WPVibe plugin (direct): HTTP 200, but the response did not identify the WPVibe plugin.

WordPress authorization endpoint (direct): Could not verify.

The same REST API URLs return valid JSON in my phone’s browser.

Is InfinityFree’s browser security verification blocking external API connections? Is there a supported way to allow WPVibe to connect on free hosting?

2

Welcome to the InfinityFree community forum! Good to have you here.

  • Most people answering here are volunteers. They’re often the fastest source of help. Admin (the only staff member) checks in about once a day for issues on our end.
  • Volunteers can’t see your account or website. Share what you actually see, like error messages and what happens when you try something. That’s more useful than your theory of what’s wrong.
  • AI tools often get InfinityFree wrong. If a volunteer’s advice differs from what an AI told you, please try the volunteer’s suggestion first.
  • Solving an issue is a joint effort. Try the suggestions you get and report back what happened.
3

Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.

Yes, that’s almost certainly what’s happening. The browser security system on InfinityFree free hosting sits in front of every URL on your site, and it doesn’t pass external services through.

It checks that the visitor can run JavaScript and accept cookies. Your phone’s browser does both, so you get the JSON. WPVibe’s server can’t, so it gets a short HTML page instead, usually with status 200. That fits what you’re seeing: “HTTP 200, but the response did not identify WordPress REST”. The article lists REST APIs, webhooks, and AI tools and MCP clients among the things that can’t get through.

You can confirm it if WPVibe shows the raw response. If it contains aes.js, the request was stopped by the security system and never reached WordPress.

There’s no supported way around it on free hosting. The article says the check can’t be turned off, and it can’t be excluded for one path, user agent or IP address. Authenticated requests are blocked the same way, so that includes WPVibe’s authorization endpoint. Using your own domain doesn’t change this either.

The article says premium hosting uses less restrictive protection, which allows APIs and automated tools to work. So for WPVibe, upgrading or moving is the only route.

Here’s the article with the details:

4

Yes

No