You press Update or Publish in the WordPress editor and a black bar says the save failed: "The response is not a valid JSON response". The editor sends your page to the site and expects a short data reply (JSON) back. Something got in the way and the site answered with a web page instead: a "not found" page, a firewall's "forbidden" page, or a PHP warning stuck in front of the data. The message is the same in every case, so the fix starts with finding out which reply came back. Below is a rebuilt example (not a real client), then the order of steps.
https://yoursite.com/wp-json/. A healthy site shows a screen of text and brackets. Your theme's "page not found" or the host's plain "Not Found" page means the addresses WordPress uses for saving are not reaching it (step 2 below). A "Forbidden" or "Not Acceptable" page means a firewall is in the way (step 4).wp-json/wp/v2/pages/... or .../posts/...). The Response tab shows what came back. A "Warning:" or "Deprecated:" line before the { means a plugin or the theme is printing errors into the reply (step 5)..htaccess and wp-config.php. Copy the text of the page you were editing somewhere safe: an unsaved edit is lost if the tab closes./wp-json/ addresses to WordPress. If /wp-json/ still shows a not-found page, the .htaccess file is missing or ignored, often after a host move; the pages 404 guide has the standard file and what to check on the server.https:// if the site has a certificate, and match the address in your browser bar. An http:// address there sends the editor's save to an insecure address that the browser blocks or redirects, and a redirected save loses its data. If the dashboard misbehaves after changing them, the login loop guide has the reversible wp-config.php way./wp-json/ says Forbidden or Not Acceptable, a security filter is refusing the save. Pages with embedded code, form or map snippets, or text that looks like database commands are the usual trigger.
/wp-json/ saves, or, if your control panel has a ModSecurity switch, turn it off for this domain only, save, and turn it back on./wp-json/wp/v2/ rather than turning the firewall off for the whole site.wp-config.php, if you find define( 'WP_DEBUG', true );, add define( 'WP_DEBUG_DISPLAY', false ); below it so warnings go to the log instead of into the save. Then update the plugin or theme the warning names, or switch it off.wp-content/plugins in the file manager instead (renaming keeps every setting).| What you find | What it means | Usual fix |
|---|---|---|
/wp-json/ shows a "page not found" | The saving addresses never reach WordPress (rewrite rules missing) | Save Permalinks; restore .htaccess (pages 404 guide) |
| "Forbidden", "Not Acceptable" or a security plugin's block page | A firewall refused the save, often because of code or unusual text in the page | Allow the request in the plugin, the host's ModSecurity, or the CDN's firewall |
| Fails on one page only, empty drafts save fine | The page's content trips a filter | Same as above; until then, remove the snippet, save, add it back in a Custom HTML block |
Site address in Settings starts with http:// on an https site | The save goes to an insecure address and is blocked or redirected | Set both addresses to https:// |
| "Warning:", "Notice:" or "Deprecated:" text before the data | A plugin or theme prints PHP errors into the reply | WP_DEBUG_DISPLAY false; update or replace what the warning names |
| Started right after installing or updating one plugin | That plugin interferes with saving | Switch it off, check for an update, tell its author |
Most sites need step 2 or step 4, and either takes a few minutes once you know which one it is. If the editor is still refusing to save, or the page has to go live today, that is what the box below is for. Related: pages that 404 except the home page share the first cause, and "there has been a critical error" is what a broken plugin looks like from the front of the site.