Skip to main content
Version: 1.x

HOST121: Bot challenge blocking api

What this means​

A bot-protection page is answering instead of the store's API.

The store's REST API is returning an HTML challenge page (bot protection, CAPTCHA, or DDoS interstitial) where the app expects JSON. A point-of-sale app cannot solve a browser challenge; the store's REST API needs to be allow-listed in the protection service.

Your data​

No order or product data is affected.

Troubleshoot​

  1. Identify the protection layer from the challenge page (Cloudflare, Sucuri, Kinsta and others each brand theirs) and open its settings.
  2. Allow-list the store's own REST API paths (/wp-json/ and /?rest_route=) for API traffic.
  3. On Cloudflare, add a WAF Skip rule for the REST API paths; Bot Fight Mode (Free plan) cannot be bypassed by any rule and must be turned off. The Cloudflare guide has the exact rule and a curl check.
  4. In Kinsta's bot/firewall settings, allow-list the REST API paths; on Sucuri, avoid the JavaScript-challenge DDoS mode for API routes.

Details​

Code
HOST121 (BOT_CHALLENGE_BLOCKING_API)
Severity
error
Introduced in
WCPOS 1.10.0