Third-party WordPress API integration returns 403 on a custom REST endpoint

Efe K 13 Jul, 2026 Jolt Control Panel, WordPress

Description

A third-party integration may fail to connect to a WordPress REST API endpoint and return a 403 Forbidden response, even though the endpoint is available in a browser. This can happen when automated requests are blocked by server-side bot protection rather than by WordPress itself.

Symptoms

The affected service reports that it cannot access a WordPress REST API endpoint under a custom namespace, such as /wp-json/example-plugin/v1.

Typical behaviour includes:

• The third-party platform reports a 403 Forbidden error when calling the API endpoint
• The endpoint responds normally when tested manually in a web browser
• The issue affects automated server-to-server requests rather than general site access

[Screenshot: example 403 error shown by the third-party integration]

Solution

The 403 response was caused by the platform’s bot protection blocking the third-party request user agent. In the confirmed case, the blocked requests used the Axios user agent.

1. Check the web server access logs for requests to the affected REST API endpoint.
2. Identify requests returning 403 and confirm the associated user agent.
3. If the requests are legitimate, add that user agent to the allowlist in the server’s bot protection or security layer.
4. Test the integration again to confirm the endpoint now returns a valid response to the third-party service.

For Example, allowing the Axios user agent through the bad bot blocker on Jolt Control Panel resolve issue with 403.