What does 'The REST API encountered an error' mean in WordPress Site Health?

WordPress tried to call its own REST API at /wp-json/ and the call failed. The error line names why: a time-out (cURL error 28), a block by basic auth, a security plugin or firewall (401 or 403), the server not reaching its own domain (cURL error 7), or a plugin crash (500).

How do I fix 'Your site could not complete a loopback request'?

Use the Health Check and Troubleshooting plugin to test with plugins off; if the check passes, re-enable them one at a time to find the one that blocks or slows the self-call, often by holding a PHP session. If it still fails, ask your host to allow the server to connect to its own domain and whitelist its own IP in the firewall.

Is the loopback request error serious?

It can be. Scheduled posts, automatic updates, background tasks and editing plugin or theme files from the dashboard all depend on the site calling itself, so they fail quietly while the error stays. The site's content and visitors are not affected.

More fixes

WordPress Site Health: "The REST API encountered an error" and "Your site could not complete a loopback request"

Tools, Site Health lists two critical issues that usually arrive together. They look alarming, and they matter: the block editor, scheduled posts, plugin and theme file editing, and automatic updates all rely on your site being able to call itself. Your content is fine. Something between the site and its own address is refusing the call. Here is how to find what, and the fix for each case.

What the owner sees

harborbakery.example/wp-admin/site-health.php

What the checks found

Find out which case it is (five minutes)

Read the exact error under each issue. Click the issue in Site Health. The line after "Error:" names the cause: cURL error 28 (time-out), cURL error 7 or Could not resolve host (the server cannot find or reach its own address), 401/403 (something is refusing the call), or 500 (PHP crashed while answering).
Open the REST API yourself. Visit /wp-json/ on your site. A long page of JSON means the API works from outside, so the problem is the server calling itself. A 404 means pretty permalinks or the server rules are wrong. A 403 or a login box means a security layer.
Is the site behind a password? Staging sites and "coming soon" setups often use HTTP basic auth. Your browser knows the password; the server calling itself does not, so every loopback gets 401.
Did it start after a plugin, a move or a new firewall? Security plugins, "disable REST API" plugins, Cloudflare rules and a recent domain or host change are the usual causes.

The fixes, by case

cURL error 28 (timed out): the self-call took longer than 10 seconds. Often a plugin starts a PHP session (session_start()) and holds it, so the second request waits for the first. Find the plugin with the Health Check & Troubleshooting plugin's troubleshooting mode, which disables plugins for your login only. A slow site can also do it: see the slow-admin fixes.
401 on a password-protected site: allow the server's own IP past the basic-auth rule, or switch the protection off on the live site. A "coming soon" plugin that blocks /wp-json/ for logged-out visitors needs its REST option turned on.
403 from a security plugin or firewall: a setting such as "disable REST API" or "block XML-RPC and REST" is on, or ModSecurity / Cloudflare blocks the request. Allow logged-in REST requests in the plugin and whitelist the server's own IP in the firewall rather than turning protection off.
cURL error 7 or "could not resolve host": the server cannot reach its own domain. Common right after a move: DNS points at the new host but the server still resolves the name to the old IP, or the host blocks connections from the server to itself. Your host can add the domain to the server's hosts file or allow the loopback; this is a one-line ticket.
404 on /wp-json/: go to Settings, Permalinks and click Save without changing anything. That rewrites the server rules. On Nginx, the host must have the standard WordPress try_files rule.
cURL error 60 (SSL certificate): the server's own certificate bundle is out of date or the site's certificate is incomplete. See the cURL error 60 fix.
500 or a PHP error in the reply: a plugin or theme crashes when called by the API. Turn on WP_DEBUG_LOG, run the Site Health test again, and read wp-content/debug.log for the file named.

What you see, what it means, what it needs

What you see	What it means	Usual fix
cURL error 28: Operation timed out	The self-call waited over 10 seconds	Find the plugin holding a PHP session
Unexpected result 401	Basic auth or "coming soon" blocks the server	Allow the server's IP or the REST path
Unexpected result 403	Security plugin or firewall refuses it	Allow logged-in REST, whitelist own IP
cURL error 7 / could not resolve host	Server cannot reach its own domain	Host fixes the loopback or hosts file
/wp-json/ gives 404	Rewrite rules are missing	Re-save Permalinks; Nginx try_files
Unexpected result 500	A plugin crashes on the API call	Read debug.log, update or replace it

What not to do

Do not hide the warnings with a plugin that silences Site Health. Scheduled posts and automatic security updates still fail underneath.
Do not switch off your firewall or security plugin for good. Allow the one request instead.
Do not install a "disable REST API" plugin to make the error go away. The block editor, contact forms and WooCommerce all need the REST API.
Do not edit WordPress core files. Nothing in core is broken.

Most cases are one plugin setting or one firewall rule. If both issues are still red, that is what the box below is for. Related: cURL error 28, cURL error 60, Missed scheduled posts, "Not a valid JSON response".