Fix Blocked AJAX Requests in WordPress

If your WordPress admin panels, page builders, or custom scripts suddenly stop loading data without a page refresh, a blocked AJAX request is usually the culprit. This guide walks you through the most common causes—from security plugins to file permissions—and gives you step-by-step fixes to get your site’s background requests working again.

What You’ll Need

• WordPress admin access (at least an Administrator account)
• FTP or cPanel File Manager access (for editing files directly)
• A code editor (like Notepad++ or VS Code) if you plan to edit theme or plugin files
• Browser developer tools (F12 in Chrome/Firefox) to inspect the network and console

Step-by-Step

1. Identify the exact error. Open your browser’s developer tools (F12), go to the Network tab, and filter by XHR or Fetch. Reload the page or trigger the AJAX action (like saving a post or loading a gallery). Look for a request to admin-ajax.php or wp-ajax. Click it and check the Status and Response tabs. Common statuses: 403 (Forbidden), 400 (Bad Request), 500 (Internal Server Error), or 0 (blocked by CORS or mixed content).
2. Check for mixed content. If your site is HTTPS but the AJAX URL is HTTP, the browser blocks it. Go to Settings → General in WordPress and confirm both the WordPress Address and Site Address start with https://. If they don’t, update them and save. Use a plugin like “Really Simple SSLâ€� if you’re not comfortable editing files.
3. Verify the AJAX URL is correct. In your custom code, ensure you’re using admin_url('admin-ajax.php') (or rest_url() for REST API) and not a hardcoded URL. Also, make sure you’ve localized your script with wp_localize_script() to pass the correct URL to JavaScript. If you’re using a page builder, its own AJAX URL is usually fine—skip this step.
4. Disable security plugins temporarily. Plugins like Wordfence, Sucuri, or iThemes Security often block AJAX requests if they detect unusual patterns. Go to Plugins → Installed Plugins, deactivate any security or firewall plugin, and test your AJAX again. If it works, the plugin is the issue. Re-enable it and adjust its settings—look for options like “Block suspicious requests� or “Rate limiting� and whitelist your IP or the AJAX action.
5. Check .htaccess or server rules. Some hosts or security plugins add rules that block POST requests to admin-ajax.php. Access your site’s root via FTP or cPanel, find the .htaccess file, and look for lines like RewriteRule ^admin-ajax.php - [F]. If you find any, comment them out by adding # at the start, or remove them. Save and test.
6. Test with a default theme and plugins. Switch to a default WordPress theme (like Twenty Twenty-Four) and deactivate all plugins. This isolates the problem. If AJAX works now, re-activate plugins one by one until the issue returns. That plugin is the culprit—check its settings or contact its support.
7. Check file permissions. If admin-ajax.php returns a 500 error, it might be a permissions issue. Via FTP, check that admin-ajax.php has permissions of 644 (files) and directories are 755. Never use 777. If permissions are wrong, change them and test.
8. Verify the action hook is registered. For custom AJAX, ensure you’ve added add_action('wp_ajax_my_action', 'my_function') and for logged-out users add_action('wp_ajax_nopriv_my_action', 'my_function'). If you’re missing the nopriv hook, logged-out visitors will get a 400 error. Test by logging in and out.
9. Check for PHP errors. Enable WordPress debugging by adding to wp-config.php: define('WP_DEBUG', true); define('WP_DEBUG_LOG', true); define('WP_DEBUG_DISPLAY', false);. Then trigger the AJAX and check wp-content/debug.log for PHP warnings or fatal errors. Fix any errors found—often a missing semicolon or wrong function name.
10. Clear caches. If you use a caching plugin (like WP Rocket or W3 Total Cache), clear all caches. Sometimes cached JS or CSS references an old AJAX URL. Also clear browser cache and any CDN cache (like Cloudflare).
11. Update WordPress, themes, and plugins. Outdated versions can have bugs that break AJAX. Go to Dashboard → Updates and update everything. Then test again.

Common Mistakes

• Using the wrong URL. Hardcoding http://yoursite.com/wp-admin/admin-ajax.php instead of using admin_url() causes issues with HTTPS and domain changes.
• Forgetting the nonce. If your code uses wp_nonce_field() or wp_create_nonce(), the AJAX request must include that nonce. Missing or expired nonces result in a 403 error.
• Not enqueuing scripts correctly. If you don’t use wp_enqueue_script() and wp_localize_script(), your JavaScript might run before jQuery is loaded, causing a “jQuery is not definedâ€� error.
• Blocking by server mod_security. Some hosts have mod_security rules that block POST requests with certain patterns. Temporarily disable mod_security via cPanel or contact your host to whitelist your IP.

Tips

• Use the REST API for new code. The REST API is more modern and less likely to be blocked by security plugins. Use wp_rest nonce and rest_url() instead of admin-ajax.php.
• Test with a simple script. Create a minimal AJAX call (e.g., a button that returns “Helloâ€�) to isolate whether the problem is in your custom code or the environment.
• Keep a staging site. Test changes on a staging copy before applying to production to avoid downtime.
• Use browser console. The console shows JavaScript errors that often point to the exact line where AJAX fails.

Troubleshooting

If the steps above don’t fix the issue, try these additional checks:

• Check the browser console for CORS errors. If you see “Access to XMLHttpRequest has been blocked by CORS policy,â€� your server isn’t sending the right headers. Add to your .htaccess: Header set Access-Control-Allow-Origin "*" (but be cautious with security).
• Look at the network response body. A 403 response might contain a message like “Forbiddenâ€� or “Blocked by Wordfence.â€� That tells you which plugin is blocking. A 0 status usually means the request was aborted due to mixed content or a timeout.
• Check your host’s error logs. Access cPanel → Error Logs, or ask your host to check the server logs for the exact time of the failed request. Look for PHP fatal errors or mod_security messages.
• Try a different browser or incognito mode. Browser extensions (like ad blockers) can block AJAX requests. Disable them temporarily to rule that out.
• Reinstall WordPress core. If admin-ajax.php is corrupted, download a fresh copy from wordpress.org and replace the file via FTP (keeping the same permissions).

Frequently Asked Questions

Why is my AJAX request returning 0?

A status of 0 usually means the request was blocked before it reached the server—often due to mixed content (HTTPS page with HTTP request) or a CORS policy. Check the browser console for specific error messages.

How do I find the AJAX URL in WordPress?

In your browser’s developer tools, go to the Network tab and look for a request to admin-ajax.php. The full URL is typically https://yoursite.com/wp-admin/admin-ajax.php. In code, use admin_url('admin-ajax.php').

What is a nonce and why is it required?

A nonce is a security token that verifies the request comes from a legitimate user. WordPress checks it to prevent CSRF attacks. You must generate it with wp_create_nonce('my_action') and pass it in the AJAX data, then verify with check_ajax_referer().

Can a CDN block AJAX requests?

Yes, some CDNs cache POST requests or have firewall rules that block them. Try purging your CDN cache, or temporarily bypass the CDN (e.g., via a development URL) to test.

Why does AJAX work for logged-in users but not visitors?

This happens when you only register the wp_ajax_ hook and not the wp_ajax_nopriv_ hook. Add the nopriv hook to allow logged-out users to make requests.

How do I test if admin-ajax.php is working?

Create a simple PHP function that returns “OKâ€� and hook it to wp_ajax_test. Then call https://yoursite.com/wp-admin/admin-ajax.php?action=test in your browser. If you see “OK,â€� the file is working.

Related

• Best Turn-Based Strategy Games Like Zero Company for Steam Machine
• Dropbox Duplicate Files? Causes & Fixes
• 30-Minute LinkedIn Plan for a Recruiter-Ready Profile