REST API DELETE/PUT requests blocked by host firewalls (403 Forbidden)

[code-snippets-bot]

Report

Forum topics:

• https://wordpress.org/support/topic/critical-bug-version-update-triggers-rest-api-403-forbidden-on-deletion/
• https://wordpress.org/support/topic/trash-action-issue/

After updating to 3.10.0, deleting snippets fails with a 403 Forbidden error on the REST API endpoint wp-json/code-snippets/v1/snippets/. A separate report shows net::ERR_HTTP2_PROTOCOL_ERROR with 0 bytes on the same action. Both are caused by host firewalls blocking DELETE/PUT HTTP verbs.

Expected behavior

Snippet operations (delete, update, activate, deactivate) should work on standard hosting environments without requiring users to disable server security rules.

Cause

The admin communicates with the REST API using real DELETE and PUT verbs. Many hosts permit only GET and POST, so the request is rejected upstream before reaching WordPress.

Related work

• Pull request: fix: send REST writes as POST with a method override #467