All-In-One Security (AIOS)

If you are using the All-In-One Security (AIOS) – Security and Firewall plugin, make sure to not disable access to the WordPress REST API.

This plugin has a setting to disable the WordPress REST API access when you are not logged in. Enabling this setting will cause a 500 server error on refresh (when using facets), which causes FacetWP to malfunction.

To disable this setting, go to:

WP Security > Firewall > WP REST API > Disallow unauthorized REST requests

Disable the 'Disallow unauthorized REST requests' setting in the AIOS plugin. — Disable the “Disallow unauthorized REST requests” setting in the AIOS plugin.

Tip:If you want to protect specific WordPress REST API endpoints (like FacetWP’s endpoints) from being accessed by non-logged-in users, check out the WordPress REST API Authentication plugin. Or you can protect the entire WordPress API from non-logged-in users. In both scenarios, because FacetWP needs its own /facetwp/v1/refresh endpoint to function, your facets will then only work for logged-in users. Additionally, you’ll need to add this fix to pass authentication data through REST API requests, to fix facet filtering.

Search the Help Center

All-In-One Security (AIOS)

See also

Your site deserves the best filtering

Search the Help Center

All-In-One Security (AIOS)

See also

Related articles

Your site deserves the best filtering