I was able to reproduce and isolate the manual purge failure in version 2.4.4.<\/p>\n\n\n\n
Symptom<\/strong><\/p>\n\n\n\n Manual cache purge from the WordPress admin bar or plugin settings page fails with:<\/p>\n\n\n\n The AJAX response from Hestia API itself is working<\/strong><\/p>\n\n\n\n I verified the Hestia side independently.<\/p>\n\n\n\n The configured access key also passes After verifying the API credentials, I called the plugin purge method directly through WP-CLI:<\/p>\n\n\n\n Result:<\/p>\n\n\n\n Therefore the Hestia API request and the plugin’s actual purge method work correctly. The failure only occurs through the browser AJAX manual-purge path.<\/p>\n\n\n\n PHP configuration was also checked:<\/p>\n\n\n\n The AJAX request is not being cached and reaches WordPress normally.<\/p>\n\n\n\n Regression between 2.4.3 and 2.4.4<\/strong><\/p>\n\n\n\n The 2.4.4 “Fix all Plugin Check errors” change modified the nonce request field in to:<\/p>\n\n\n\n and changed the PHP validation in In my environment this consistently results in Patch tested<\/strong><\/p>\n\n\n\n I prepared a minimal compatibility patch.<\/p>\n\n\n\n The JavaScript request field is restored to the 2.4.3 name:<\/p>\n\n\n\n The PHP handler explicitly reads the POST value, unslashes and sanitizes it, while also accepting the 2.4.4 This does not remove or bypass nonce\/CSRF validation. It only restores the previously working POST field and handles the input explicitly in a Plugin Check-friendly way.<\/p>\n\n\n\n I also bumped the patched build to I can provide the complete patch\/diff if useful.<\/p>\n\n\n\n Note: this finding specifically isolates the manual AJAX purge nonce failure<\/strong>. Automatic purge does not go through this AJAX nonce path and should be investigated separately if it is also failing.<\/p>\n\n\n\nThe Hestia Nginx Cache could not be purged!<\/code><\/p>\n\n\n\n\/wp-admin\/admin-ajax.php<\/code> is HTTP 200, but contains:<\/p>\n\n\n\n{\n \"success\": false,\n \"data\": {\n \"message\": \"The Hestia Nginx Cache could not be purged!\",\n \"error\": \"Invalid nonce.\"\n }\n}\n<\/code><\/pre>\n\n\n\nv-purge-nginx-cache<\/code> succeeds with exit code 0.<\/p>\n\n\n\nv-check-access-key<\/code>.<\/p>\n\n\n\nHestia_Nginx_Cache::get_instance()->purge(true);\n<\/code><\/pre>\n\n\n\nHTTP CODE: 200\nHESTIA EXIT CODE: 0\n<\/code><\/pre>\n\n\n\nPHP 8.4.24\nrequest_order: GP\nvariables_order: GPCS\n<\/code><\/pre>\n\n\n\nassets\/js\/admin.js<\/code> from:<\/p>\n\n\n\nwp_nonce: nonce.textContent,\n<\/code><\/pre>\n\n\n\n_wpnonce: nonce.textContent,\n<\/code><\/pre>\n\n\n\nincludes\/admin.php<\/code> from the previous POST-based handling to:<\/p>\n\n\n\n$query_arg = '_wpnonce';\n$valid_nonce = isset($_REQUEST[$query_arg])\n ? wp_verify_nonce(\n $_REQUEST[$query_arg],\n 'hestia-nginx-cache-purge-wp-nonce'\n )\n : false;\n<\/code><\/pre>\n\n\n\nInvalid nonce.<\/code> for the manual AJAX purge, while the direct purge method succeeds.<\/p>\n\n\n\nwp_nonce: nonce.textContent,\n<\/code><\/pre>\n\n\n\n_wpnonce<\/code> field as a fallback for cached JavaScript:<\/p>\n\n\n\n$nonce = '';\n\nif (isset($_POST['wp_nonce'])) {\n $nonce = sanitize_text_field(wp_unslash($_POST['wp_nonce']));\n} elseif (isset($_POST['_wpnonce'])) {\n $nonce = sanitize_text_field(wp_unslash($_POST['_wpnonce']));\n}\n\n$valid_nonce = $nonce !== ''\n ? wp_verify_nonce(\n $nonce,\n 'hestia-nginx-cache-purge-wp-nonce'\n )\n : false;\n<\/code><\/pre>\n\n\n\n2.4.4.1<\/code> so the plugin’s versioned admin.js<\/code> URL changes and browsers do not keep the 2.4.4 JavaScript cached.<\/p>\n\n\n\n