Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.
Yes, that’s almost certainly what’s happening. The browser security system on InfinityFree free hosting sits in front of every URL on your site, and it doesn’t pass external services through.
It checks that the visitor can run JavaScript and accept cookies. Your phone’s browser does both, so you get the JSON. WPVibe’s server can’t, so it gets a short HTML page instead, usually with status 200. That fits what you’re seeing: “HTTP 200, but the response did not identify WordPress REST”. The article lists REST APIs, webhooks, and AI tools and MCP clients among the things that can’t get through.
You can confirm it if WPVibe shows the raw response. If it contains aes.js, the request was stopped by the security system and never reached WordPress.
There’s no supported way around it on free hosting. The article says the check can’t be turned off, and it can’t be excluded for one path, user agent or IP address. Authenticated requests are blocked the same way, so that includes WPVibe’s authorization endpoint. Using your own domain doesn’t change this either.
The article says premium hosting uses less restrictive protection, which allows APIs and automated tools to work. So for WPVibe, upgrading or moving is the only route.
Here’s the article with the details: