I have a multisite wordpress installation on aws linux, working perfectly fine. The WP Rest api is also working exactly as it should. Except for one single case.

/wp-json/wp/v2/posts?author=<some int>

For everything else, including my custom endpoints, and custom params/fields added to the api, it works perfectly. But the moment i add the author part, it returns 404 on all sites. eg:

/wp-json/wp/v2/posts?author_exclude=1     //this works
/wp-json/wp/v2/posts?page=2               // this also works
/wp-json/wp/v2/posts?page=2&author=abc    // this also works and returns invalid author
/wp-json/wp/v2/posts?page=2&author=1      // this returns 404 page not found

From some of the other similar questions, I found that this issue could be due to permalinks, but I am using custom permalinks


I have tried changing the permalink to no effect. Another solution I found is to change all the deny to allow in htaccess. I am not well-versed in htaccess, so i have not modified it for fear of causing some security issues. As for other related info, I am also using jwt and disable rest api plugin(with only jwt endpoints enabled).

Any help would be appreciated, please.

  • A quick test on my local installation shows that your /wp-json/wp/v2/posts?author=<some int> endpoint should work just fine -- it'll return an array of posts, or an empty array [] if the author doesn't exist or has no posts. Have you tried turning off all your plugins to see if one of them is the culprit?
    – Pat J
    Aug 3, 2019 at 21:43
  • 1
    @PatJ Found the culprit, it was Wordfence. Sadly, Turning it off or switching to a different plugin is not an option. My only idea is to add an endpoint for this in my own plugin. Any other ideas would be most welcome. Aug 8, 2019 at 6:10
  • 1
    I'd open a ticket with Wordfence support, and see what they say.
    – Pat J
    Aug 8, 2019 at 13:41

2 Answers 2


I'm facing the same problem with a Multisite running Wordfence and JWT. I'm not sure if the solution here works for your case...

The following doesn't work, it gives a 404 response. If we remove data.author it works without problem.

    url: 'https://example.com/wp-json/wp/v2/posts',
    method: 'POST',
    crossDomain: true,
    dataType: 'json',
    data: { 'author':'1', 'title':'Hello world', 'content':'lorem ipsum', 'status':'publish' },
    beforeSend: function ( xhr ) {
        xhr.setRequestHeader( 'Authorization', 'Bearer <token>' );
    success: function( data, txtStatus, xhr ) {
        console.log( xhr.status, data );

This does work but I don't know why:

fetch( 'https://example.com/wp-json/wp/v2/posts', {
    method: 'POST',
    body: JSON.stringify( {
        author: '1',
        content: 'lorem ipsum',
        title: 'Nice, it works!',
        status: 'publish'
    } ),
    headers: {
        'Content-Type': 'application/json',
        Authorization: 'Bearer <token>'
} )
.then( res => res.json() )
.then( res => console.log( res ) );

I had three issues with Wordfence:

  • I couldn't make application passwords work;
  • if we have 2FA enabled, authentication doesn't work;
    I solved both above using an Editor user without 2FA nor app password;
  • finally, not being able to set the author that brought me to this question.

A while ago, Wordfence added the following option:

Prevent discovery of usernames through '/?author=N' scans, the oEmbed API, the WordPress REST API, and WordPress XML Sitemaps

This prevents requesting JSON requests that include the author parameter.

There's some documentation on this, here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.