The block editor fails to save and reports an invalid JSON response. How can the failing REST request be checked without disabling security across the whole site?

An invalid JSON message describes the response the editor could not process. In this hypothetical case, preserve the draft locally before repeating the save, then open the browser's Network panel and identify the request that fails. Record its method, destination, status, response type and a sanitized excerpt of its body. Do not publish cookies, authorization headers or nonces.

The response provides the next lead. An HTML login page suggests investigating authentication or redirects. A 403 response calls for checking the returned error and the relevant access or firewall logs. A 404 points toward the requested route and routing configuration. A 5xx response warrants correlation with server logs. These are directions for investigation, not definitive diagnoses based on status alone.

For requests made inside a logged-in WordPress session, REST cookie authentication also uses a nonce, and the account still needs the capability required by the operation. Re-authenticating and reloading the editor can help distinguish an expired session from a reproducible application problem. Opening the REST index successfully does not prove that an authenticated save request succeeds.

If a security rule blocks the request, correlate its timestamp or request identifier with the rule log. Any trial exception should be limited to the necessary operation, reviewed by the administrator and removed if it does not explain the result. A staging copy can isolate plugin conflicts without removing protection across the live site. Confirm the fix by saving and reopening a draft and reviewing the actual successful response.

Sources: WordPress REST authentication and HTTP response status codes.