The WordPress REST error rest_cookie_invalid_nonce means cookie-authenticated request validation rejected the supplied nonce. It is not proof that your firewall blocked the API. Capture the JSON error and compare the current login session with the page that supplied the nonce.
Preserve unsaved work first
If an editor cannot save, retain the content through its supported recovery or local-copy workflow before signing out or reloading. Record the request path, HTTP status and error code. Do not paste cookies, nonce values or full authenticated requests into a public ticket.
A branded HTML challenge suggests a different layer. Use the REST API WAF diagnosis when the response is not a WordPress JSON authentication error.
Compare a fresh session with the stale screen
Open a new authenticated editor screen in the same intended site. If that request works while a long-open tab fails, investigate a stale nonce or changed session. Signing in again can restore the current session, but it does not fix a cache serving old authenticated HTML.
WordPress's REST authentication handbook describes cookie authentication and the wp_rest nonce, commonly sent as X-WP-Nonce. Its validation implementation distinguishes a missing nonce from an invalid supplied nonce. Neither should be repaired by removing the validation function.
Fresh screen: Authorized save works. Old screen: Original failure explained. Logged out: Protected route denied. Evidence: No cookie values logged. Explanatory checklist, not a customer test result.
Check the origin of the nonce
For a custom frontend, ask the developer where the nonce is generated and how the request obtains the corresponding session cookies. Compare the page origin, REST endpoint hostname and HTTPS configuration. A copied nonce from another browser, user or environment is not a reusable API credential.
Inspect cache headers for the HTML that embeds user-specific state. Determine whether the CDN, page cache or service worker returned an old authenticated response. Test a narrow cache bypass in staging and compare the same request, rather than purging the entire site repeatedly.
Do not log actual nonce or cookie contents. A useful diagnostic record says whether the header was present, which screen created the request and whether the session was refreshed.
Keep permissions separate
Once nonce validation succeeds, the route may still deny the requested action because the user lacks a capability. That is not a reason to promote the user to administrator. Test the intended role and operation.
External server integrations should use their supported authentication method rather than borrowing a browser session nonce. Keep secrets server-side and do not add an application password to public JavaScript.
Prove the repaired workflow
Save a disposable draft using the affected role, confirm its stored content, and repeat after the original navigation sequence. Check that logged-out or unauthorized requests remain denied. HandL WP can trace a failing REST save using a redacted response and the page-cache path while preserving request protection.
References reviewed October 13, 2026. Examples are explanatory, not customer test results.