WordPress REST API proxy versus origin split response

When this happens

Use this when a cdn, load balancer, reverse proxy, or waf sits in front of the service. Do not stop at the screen message; validate whether the edge/proxy or the origin server creates the failure first.

Symptom checklist

• REST API appears repeatedly in the WordPress UI or logs.
• debug.log, plugin list, permalink, PHP memory differs between successful and failed requests.
• The issue appears only after separating WordPress core from plugin/theme code.
• It often follows deploys, permission changes, configuration edits, or data refreshes.

Likely causes

• REST API specifically changes the investigation surface for WordPress: verify the exact failing object, route, user, and timestamp before applying the broader pattern.
• A plugin or theme throws a PHP fatal error before WordPress can render the page.
• Security, permalink, or server rewrite rules block REST API routes.
• wp-config.php database credentials or host differ from the active database.
• Object cache serves stale options after a migration.
• WP-Cron is disabled, blocked by loopback, or duplicated with system cron.
• For the proxy versus origin split case, the first useful clue is whether the edge/proxy or the origin server creates the failure.

First 1-minute checks

1. Write down the first failure time, latest change, affected user, path, and object ID.
2. Compare debug.log, plugin list, permalink, PHP memory for success and failure in the same window.
3. Test the hypothesis: WordPress failure caused by plugin fatal error, REST route block, database credentials, object cache, or WP-Cron loop.
4. Classify this as proxy versus origin split: whether the edge/proxy or the origin server creates the failure.
5. Capture current values before changing configuration.

First evidence

Treat REST API as a proxy versus origin split case. First collect evidence for whether the edge/proxy or the origin server creates the failure.

Output examples

Normal output

Direct origin and routed proxy return equivalent status and headers.

Failing output

Origin succeeds but proxy fails, or proxy succeeds while direct origin exposes the real backend error.

Output-to-action branches

• A CDN, load balancer, reverse proxy, or WAF sits in front of the service.
  Test direct origin and routed traffic separately, then change only the layer that differs.
• The working and failing outputs differ.
  Act on the differing layer first: For REST API, apply the fix only after reproducing the same condition and saving the before/after evidence for this exact code.
• Command output is normal but users still fail.
  Separate browser cache, cookies, permissions, and network location before declaring it fixed.

Do not do this

• Do not assume the CDN error code is the application root cause.
• Do not change multiple layers before identifying the failing layer.
• Do not delete production data, grant broad permissions, or disable security controls as a first response.

Evidence quality

Auto-generated operator draft: includes issue-specific causes, commands, output branches, and unsafe-action warnings. Official-source links and real incident validation are queued for enrichment.

Commands to run first

grep -R "REST API" ./logs

wp plugin list

wp theme list

tail -n 200 wp-content/debug.log

wp rewrite flush --hard

wp plugin list --status=active || true

wp theme list || true

wp option get siteurl || true

grep -R "PHP Fatal\|REST\|database connection\|wp-cron" wp-content/debug.log ./logs

curl -Iv https://example.com --resolve example.com:443:ORIGIN_IP

Fix order

1. Record the full REST API message, failing URL, user, object ID, and latest change.
2. Collect issue-specific evidence for WordPress failure caused by plugin fatal error, REST route block, database credentials, object cache, or WP-Cron loop.
3. Compare the failing case with a successful case before editing settings.
4. If this is the proxy versus origin split branch, Test direct origin and routed traffic separately, then change only the layer that differs.
5. Re-check with the same command and URL, then record the normal output.

Actions by cause

• For REST API, apply the fix only after reproducing the same condition and saving the before/after evidence for this exact code.
• Enable WP_DEBUG logging temporarily and identify the first plugin or theme fatal error.
• Flush permalinks and verify REST routes through the web server.
• Check database host, user, password, and table prefix in wp-config.php.
• Clear object cache after moving domains or databases.
• Use one cron mechanism and verify loopback requests succeed.
• For the proxy versus origin split branch, Test direct origin and routed traffic separately, then change only the layer that differs.

Evidence links

• WordPress debugging official
• WP-CLI handbook official

Verification metadata

• operator-draft
• official-reference-linked
• 2026-07-23

Update queue

• Review cadence
  weekly-source-review
• Next enrichment
  Add one official-source check and one real output example for WordPress REST API.

Environment-specific checks

• Shared hosting, proxies, VPNs, or CDN layers can change WordPress core from plugin/theme code results.
• Do not trust only the WordPress UI; compare command output.
• Japanese hosting panels may show completion before DNS or SSL fully propagates.
• Test from both office and external networks.

Prevent it next time

• Store normal examples for debug.log, plugin list, permalink, PHP memory.
• Add plugin isolation, permalink flush, PHP limit tuning to the release checklist.
• Keep recurring errors in the same note format.
• Split alerts by error rate, latency, certificates, disk, and permission changes.

Related notes

• WordPress white screen after plugin update
• WordPress white screen first triage response
• WordPress 500 first triage response
• WordPress plugin conflict first triage response
• WordPress theme error first triage response
• WordPress permalink first triage response
• WordPress REST API first triage response
• WordPress upload limit first triage response