"Updating failed. The response is not a valid JSON response." — WordPress fix

The block editor (Gutenberg) saves posts by calling the WordPress REST API at /wp-json/wp/v2/posts. It expects a JSON response back. When it gets anything else — an HTML 404 page, a redirect to HTTPS, a security-plugin block page, or a login screen — it can't parse the response, so it throws "not a valid JSON response".

The error is a symptom, not the cause. The real question is what the REST API returned instead of JSON. Ninety-five percent of the time it's one of four things below.

The REST API relies on pretty permalinks. If your .htaccess or nginx config lost its permalink rewrite rules — common after a migration, host change, or plugin conflict — /wp-json/ returns 404 HTML instead of routing to the REST API.

Log into wp-admin. Go to Settings → Permalinks. Don't change anything — just click "Save Changes" at the bottom. WordPress rewrites the .htaccess rules (or reminds you what to add for nginx).

Try saving your post again. If the error's gone, this was your problem.

Go to Settings → General. The "WordPress Address (URL)" and "Site Address (URL)" fields must match exactly — both HTTPS, both with or without www, no trailing slashes.

If they mismatch (one is https://example.com, the other is https://www.example.com), the REST call gets 301-redirected on save and the block editor sees HTML redirect content instead of JSON.

Fix both to the exact canonical version of your domain, save, hard-refresh, try again.

Wordfence, iThemes Security, SiteGround Security, All-In-One WP Security, and many host-level WAFs let you "disable REST API for non-authenticated users". If enabled, the block editor's authenticated requests still get blocked because the plugin's rule is too broad.

Temporarily deactivate your security plugin, try saving a post. If it works, re-enable the plugin and find the REST API restriction — whitelist /wp-json/wp/v2/ for logged-in users, or disable that specific rule.

Cloudflare is another common culprit: a WAF rule can block POST requests to /wp-json/ if you enabled the WordPress managed ruleset with aggressive settings. Check Cloudflare → Security → WAF → Managed Rules and disable the WordPress rule temporarily to test.

If none of the above worked, this is the diagnostic that finds the exact cause every time.

Open the post in the block editor. Open browser DevTools (F12 → Network tab). Click "Update" on the post. Look for the request to /wp-json/wp/v2/posts/[ID]. Click it, then look at the Response tab.

If you see HTML: read the first few lines. A 404 page means permalinks (fix #1). A login form means an auth issue — clear cookies and log back in. A Cloudflare/Sucuri block page means the WAF (fix #3). A PHP fatal error means a broken plugin (deactivate plugins one at a time).

This one 30-second check tells you exactly which fix to apply. It's the diagnostic every engineer runs first.

If you've resaved permalinks, matched URLs, disabled security plugins, and the Network tab still shows a weird response — the issue is likely at the host or server level (mod_security, PHP-FPM misconfig, nginx rewrite rule missing). Fixing that means shell access and knowing what you're editing.

WebCare Studios includes REST API and block editor fixes on every care plan. If you'd rather have an engineer just fix it, we can usually resolve this in under 15 minutes.