Why Does Blaze Commerce Say My Site Is Blocking the REST API?

A security plugin on your site has switched off the WordPress REST API for visitors who are not logged in, so Blaze Commerce cannot read the one public endpoint it uses to verify your store. Update Blaze AI Discovery to 1.1.2 or later, or allow /wp-json/blazeaid/v1/ping in the security plugin.

What happened

When you turn on cloud checks, Blaze Commerce verifies that it is talking to your store by reading one public endpoint on your site: /wp-json/blazeaid/v1/ping. It returns only the plugin version and a one-time verification token; no store data.

Your site answered that request with HTTP 401 “Sorry, you do not have permission to make REST API requests.” That message comes from WordPress when a security plugin has restricted the REST API to logged-in users. Common sources: Wordfence, Solid Security (formerly iThemes; WordPress Tweaks → REST API: Restricted Access), the “Disable REST API” and “Disable WP REST API” plugins, and some host-level firewalls.

How to fix it

1. Update Blaze AI Discovery to 1.1.2 or later. From 1.1.2 the plugin exempts its own verification route from those filters, so in most cases nothing else is needed. Then open AI Discovery → Store Audit and run the audit again.
2. If verification still fails, allow the path /wp-json/blazeaid/v1/ping in the security plugin’s REST API settings:
   • Solid Security: Settings → WordPress Tweaks → REST API → Default Access, or add blazeaid/v1 to the allowed routes.
   • Disable REST API (plugin): Settings → Disable REST API → Unauthenticated users → allow blazeaid/v1/ping.
   • Wordfence: Firewall → Allowlisted URLs → add /wp-json/blazeaid/v1/ping.
3. Run the audit again. The notice clears once the ping answers with the plugin’s JSON.

Why the endpoint has to be public

The token proves that the store asking for data is the store the request claims to be; it is the same pattern WooCommerce uses for webhook verification. Nothing else in the plugin’s REST namespace is public: every other route requires the manage_woocommerce capability.