# HOST121: Bot challenge blocking api

## What this means[​](#what-this-means "رابط مباشر إلى What this means")

A bot-protection page is answering instead of the store's API.

The store's REST API is returning an HTML challenge page (bot protection, CAPTCHA, or DDoS interstitial) where the app expects JSON. A point-of-sale app cannot solve a browser challenge; the store's REST API needs to be allow-listed in the protection service.

## What to do[​](#what-to-do "رابط مباشر إلى What to do")

Export diagnostics and contact support. Retry after making the change above; retrying without it will fail the same way.

## Your data[​](#your-data "رابط مباشر إلى Your data")

No order or product data is affected.

## Troubleshoot[​](#troubleshoot "رابط مباشر إلى Troubleshoot")

1. Identify the protection layer from the challenge page (Cloudflare, Sucuri, Kinsta and others each brand theirs) and open its settings.
2. Allow-list the store's own REST API paths (/wp-json/ and /?rest\_route=) for API traffic.
3. On Cloudflare, Bot Fight Mode cannot be bypassed per-path — use Super Bot Fight Mode's 'definitely automated' allow rules or disable it for this zone.
4. On Kinsta, enable the /wp-json/ allow toggle; on Sucuri, avoid the JavaScript-challenge DDoS mode for API routes.

## Where to look[​](#where-to-look "رابط مباشر إلى Where to look")

When WCPOS can save this error, it is recorded on the device that raised it. Open **Store health → Logs** (the heart-pulse icon at the bottom of the navigation drawer), find the entry marked with this code and expand it: the expanded row shows the plain-language reason and the context captured at the moment of failure. For a store request, that context may include the server’s own error code (`serverCode`), the HTTP `status` or the `endpoint`; the fields shown depend on where the failure occurred. When reporting a problem, use **Copy debug info** at the top of the Logs screen (**Share debug info** on phones and tablets) rather than screenshots: it bundles the app version, connection state and the most recent errors. Logs are kept for at most 30 days, so collect them while the problem is fresh. Also copy any browser-console error that appeared before the POS was able to write its own log entry.

## Details[​](#details "رابط مباشر إلى Details")

* **Code:** `HOST121` (`BOT_CHALLENGE_BLOCKING_API`)
* **Severity:** error
* **Introduced in:** WCPOS 1.10.0