# HOST121: Bot challenge blocking api

## What this means[​](#what-this-means "What this meansへの直接リンク")

A bot-protection page is answering instead of the store's API.

The store's REST API is returning an HTML challenge page (bot protection, CAPTCHA, or DDoS interstitial) where the app expects JSON. A point-of-sale app cannot solve a browser challenge; the store's REST API needs to be allow-listed in the protection service.

## What to do[​](#what-to-do "What to doへの直接リンク")

Export diagnostics and contact support. Retry after making the change above; retrying without it will fail the same way.

## Your data[​](#your-data "Your dataへの直接リンク")

No order or product data is affected.

## Troubleshoot[​](#troubleshoot "Troubleshootへの直接リンク")

1. Identify the protection layer from the challenge page (Cloudflare, Sucuri, Kinsta and others each brand theirs) and open its settings.
2. Allow-list the store's own REST API paths (/wp-json/ and /?rest\_route=) for API traffic.
3. On Cloudflare, Bot Fight Mode cannot be bypassed per-path — use Super Bot Fight Mode's 'definitely automated' allow rules or disable it for this zone.
4. On Kinsta, enable the /wp-json/ allow toggle; on Sucuri, avoid the JavaScript-challenge DDoS mode for API routes.

## Where to look[​](#where-to-look "Where to lookへの直接リンク")

When WCPOS can save this error, it is recorded on the device that raised it. Open **Store health → Logs** (the heart-pulse icon at the bottom of the navigation drawer), find the entry marked with this code and expand it: the expanded row shows the plain-language reason and the context captured at the moment of failure. For a store request, that context may include the server’s own error code (`serverCode`), the HTTP `status` or the `endpoint`; the fields shown depend on where the failure occurred. When reporting a problem, use **Copy debug info** at the top of the Logs screen (**Share debug info** on phones and tablets) rather than screenshots: it bundles the app version, connection state and the most recent errors. Logs are kept for at most 30 days, so collect them while the problem is fresh. Also copy any browser-console error that appeared before the POS was able to write its own log entry.

## Details[​](#details "Detailsへの直接リンク")

* **Code:** `HOST121` (`BOT_CHALLENGE_BLOCKING_API`)
* **Severity:** error
* **Introduced in:** WCPOS 1.10.0