The fact that https://www.greataustralianpods.com/wp-json/ returns JSON confirms that the REST API root is accessible, but the Widgets editor may still be failing on the specific authenticated request used to save widget changes.
Could you please check the failed request from the Widgets screen?
Open Appearance → Widgets, then open your browser’s Developer Tools and select the Network tab. Edit a widget, click Update, and look for a failed request containing wp-json, widgets, or sidebars.
Please share:
• The request URL
• The HTTP status code
• The response shown in the Response or Preview tab
• Any related browser console error
The endpoint https://www.greataustralianpods.com/wp-json/wp/v2/widgets can also be opened directly, but it may return a permission error when accessed without the authenticated editor request. A valid JSON permission error is normal and only confirms that the route exists.
Since the issue affects every widget and every widget area, this is more likely to be a failed REST save request than a problem with one specific widget. A 403 response may point to a security plugin, firewall, or ModSecurity rule, while a 500 response may indicate a PHP error or plugin or theme conflict.
It would also be worth checking Tools → Site Health for REST API errors and reviewing the WordPress debug log after reproducing the issue.
No response data available for this request
418 OPTIONS https://www.greataustralianpods.com /wp-json/batch/v1?_locale=user api-fetch.min.js:2(fetch) x-unknown-content-type
Status
418
VersionHTTP/2
Transferred484 B (0 B size)
Referrer Policystrict-origin-when-cross-origin
Request PriorityHighest
DNS ResolutionSystem
content-length
0
date
Tue, 21 Jul 2026 10:00:04 GMT
permissions-policy
camera=(), microphone=(), geolocation=(), payment=()
referrer-policy
strict-origin-when-cross-origin
server
LiteSpeed
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
User-Agent,Accept-Encoding
x-content-type-options
nosniff
X-Firefox-Spdy
h2
x-frame-options
SAMEORIGIN
x-litespeed-tag
a71_
x-qc-pop
OC-AU-BNE-309
x-xss-protection
1; mode=block
Accept
application/json, */*;q=0.1
Accept-Encoding
gzip, deflate, br, zstd
Accept-Language
en-AU,en;q=0.9,en-US;q=0.8
Connection
keep-alive
Cookie
[ TOTALLY DELETED ]
1
Host
www.greataustralianpods.com
Origin
https://www.greataustralianpods.com
Priority
u=0
Referer
https://www.greataustralianpods.com/wp-admin/widgets.php
Sec-Fetch-Dest
empty
Sec-Fetch-Mode
cors
Sec-Fetch-Site
same-origin
Sec-GPC
1
TE
trailers
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0
X-WP-Nonce
986c2058c3
-
This reply was modified 18 hours, 37 minutes ago by
cheryanne.
everything else seems to be
Status
200
VersionHTTP/2
Transferred975 B (47 B size)
Referrer Policystrict-origin-when-cross-origin
DNS ResolutionSystem
access-control-allow-credentials
true
access-control-allow-origin
https://www.greataustralianpods.com
cache-control
no-cache, must-revalidate, max-age=0, no-store, private
content-encoding
br
content-length
51
content-security-policy
frame-ancestors 'self';
content-type
application/json; charset=UTF-8
date
Tue, 21 Jul 2026 09:58:53 GMT
expires
Wed, 11 Jan 1984 05:00:00 GMT
permissions-policy
camera=(), microphone=(), geolocation=(), payment=()
referrer-policy
strict-origin-when-cross-origin
server
LiteSpeed
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding,User-Agent,Accept-Encoding
x-content-type-options
nosniff
X-Firefox-Spdy
h2
x-frame-options
SAMEORIGIN
x-litespeed-cache-control
no-cache
x-litespeed-tag
a71_
x-powered-by
PHP/8.3.31
x-qc-pop
OC-AU-BNE-309
x-robots-tag
noindex
x-xss-protection
1; mode=block
Accept
application/json, text/javascript, */*; q=0.01
Accept-Encoding
gzip, deflate, br, zstd
Accept-Language
en-AU,en;q=0.9,en-US;q=0.8
Connection
keep-alive
Content-Length
80
Content-Type
application/x-www-form-urlencoded; charset=UTF-8
Cookie
[ Totally deleted ]
1
Host
www.greataustralianpods.com
Origin
https://www.greataustralianpods.com
Referer
https://www.greataustralianpods.com/wp-admin/widgets.php
Sec-Fetch-Dest
empty
Sec-Fetch-Mode
cors
Sec-Fetch-Site
same-origin
Sec-GPC
1
TE
trailers
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0
X-Requested-With
XMLHttpRequest
Thank you. The failed request identifies the likely cause:
OPTIONS /wp-json/batch/v1?_locale=user is returning HTTP status 418 with an empty response.
That is not a normal WordPress REST API response. The request appears to be getting blocked before WordPress can return JSON, which is why the Widgets editor reports that the response is not valid JSON.
The response headers show LiteSpeed, and the request information suggests Wordfence is also active. Please try the following:
- Temporarily disable Wordfence and test saving a widget again.
- If the issue remains, temporarily disable any other security, firewall, caching, or optimization plugins.
- Clear the LiteSpeed and QUIC.cloud caches.
- Ask your hosting provider to check its ModSecurity or WAF logs for a blocked
OPTIONS request to:
/wp-json/batch/v1
Please provide the host with the exact time of the failed request and the HTTP 418 status.
Also, please edit your previous forum replies and remove the values shown under Cookie and X-WP-Nonce, as authentication and session information should not be posted publicly. After removing them, log out of WordPress and log back in before continuing the tests.
The normal 200 requests are not the issue. The request returning 418 is the one that needs to be investigated.
<IfModule security2_module>
SecRuleRemoveById 700075
</IfModule>
This fixed the issue (from hosting provider) – thank you so much for all your help.
