2 min read
A loopback request is WordPress making an HTTP request back to itself. Several important features depend on it: Site Health checks, WP-Cron triggering, plugin update checks, and cache purging. When loopback is blocked, those features silently break.
REST_LOOPBACK (warning): the REST API loopback request failed. Some admin features and health checks depend on loopback.
| Cause | Description |
|---|---|
| Firewall / WAF | Security rules blocking server-to-self requests |
| CDN | A CDN intercepting the internal request instead of the origin |
| Security plugins | Over-aggressive lockdown blocking loopback IPs |
| WP_HTTP_BLOCK_EXTERNAL | If defined as true in wp-config.php, ALL external HTTP (including loopback to your own domain) is blocked |
| .htaccess / rewrite rules | Custom rules breaking the API routes |
| SSL mismatch | Site URL vs certificate mismatch breaking the internal request |
If wp-config.php contains:
define('WP_HTTP_BLOCK_EXTERNAL', true);
WordPress blocks external HTTP requests: and loopback to your own domain counts as external. Fix by allowing your own host:
define('WP_HTTP_BLOCK_EXTERNAL', true);
define('WP_ACCESSIBLE_HOSTS', 'xponent.co.za');
(Or remove the block entirely: it’s a rarely-needed hardening that causes more breakage than it prevents.)
wp eval 'wp_remote_get(home_url("https://spcdn.shortpixel.ai/spio/ret_img,q_cdnize,to_webp,s_webp/xponent.co.za/")); echo is_wp_error($r) ? $r->get_error_message(): "OK";'
If you recently installed a security or firewall plugin, that’s a likely trigger: tell us when it started and what you added around that time.
Loopback works by default on Xponent infrastructure. When it breaks, it’s usually a security plugin, a custom rule, or WP_HTTP_BLOCK_EXTERNAL added after setup: we find and fix the specific cause. On managed sites we handle it for you.
