Third-party WordPress API integration returns 403 on a custom REST endpoint
Description
A third-party integration may fail to connect to a WordPress REST API endpoint and return a 403 Forbidden response, even though the endpoint is available in a browser. This can happen when automated requests are blocked by server-side bot protection rather than by WordPress itself.
Symptoms
The affected service reports that it cannot access a WordPress REST API endpoint under a custom namespace, such as /wp-json/example-plugin/v1.
Typical behaviour includes:
- The third-party platform reports a 403 Forbidden error when calling the API endpoint
- The endpoint responds normally when tested manually in a web browser
- The issue affects automated server-to-server requests rather than general site access
[Screenshot: example 403 error shown by the third-party integration]
Solution
The 403 response was caused by the platform’s bot protection blocking the third-party request user agent. In the confirmed case, the blocked requests used the Axios user agent.
- Check the web server access logs for requests to the affected REST API endpoint.
- Identify requests returning 403 and confirm the associated user agent.
- If the requests are legitimate, add that user agent to the allowlist in the server’s bot protection or security layer.
- Test the integration again to confirm the endpoint now returns a valid response to the third-party service.
For Example, allowing the Axios user agent through the bad bot blocker on Scout Control Panel resolve issue with 403.
