How to Fix the 'REST API Nonce Invalid' Error for UK WordPress Sites (2026)
17 August 2026
Troubleshoot the REST API nonce invalid error on WordPress. UK-focused fixes for caching, timezone, and GDPR-friendly settings.
What Does 'REST API Nonce Invalid' Mean?
In WordPress, a nonce is a short-lived security token that verifies a request comes from an authorised user. When you see 'REST API nonce invalid', it means WordPress couldn't validate the token attached to a REST API request – often from the block editor, a plugin, or a custom script. This error typically appears when editing posts, saving widget changes, or using AJAX-driven features. For UK site owners, this can be especially confusing if you're on managed WordPress hosting like 123 Reg or Krystal, where server-level caching can interfere with nonce generation. Understanding the token lifecycle is the first step to resolving it.
Why UK Site Owners See This Error More Often
UK websites face specific conditions that make nonce errors more likely. Our timezone flips between GMT and BST, which can cause PHP to generate nonces based on an incorrect server time – many UK hosts still default to UTC. Regional caching and CDN setups, often through UK-based providers like UKFast or Cloudflare's London PoPs, can serve stale pages to logged-in users, embedding outdated nonces. Add to that the strict GDPR and PECR rules around cookies, and some UK admins deliberately block or limit cookies, which breaks the session that nonces depend on. Recognising these local quirks helps you pinpoint the real cause faster.
Step-by-Step Fixes for Your WordPress Site
Start by logging out and back in to refresh your session. Then, clear all caching plugins, browser cache, and any server-side cache – particularly if you use WP Rocket or W3 Total Cache. Next, verify your server timezone is set correctly in wp-config.php and PHP settings; London time is key. Update WordPress, plugins, and themes, as outdated code often mishandles REST API requests. If the error persists, disable all plugins and switch to a default theme to isolate the conflict. Finally, regenerate your permalinks and check your Site URL settings – a mismatch between HTTP and HTTPS in the admin area can also trigger this.
UK Hosting and Caching: The Hidden Culprits
Your UK hosting provider can contribute to nonce errors. Shared hosting from companies like Fasthosts or 1&1 IONOS often uses aggressive page caching that ignores user login status. If you're behind a CDN, exclude the WordPress admin and REST API paths from caching, and ensure the CDN respects Vary: Cookie. For GDPR compliance, make sure your cookie consent plugin doesn't block the session cookie required for REST API authentication. Many UK agencies recommend setting the nonce lifetime to 24 hours, but that's only safe if your caching solution is correctly configured. Speak to your host about disabling Redis or Varnish for logged-in users if necessary.
How to Prevent Nonce Errors in the Future
To avoid future frustrations, adopt a proper enqueue pattern in your theme or plugin: use wp_localize_script to pass the REST nonce to JavaScript, and always call it from wp_create_nonce('wp_rest'). Set your WordPress timezone to London, and make sure your server clock is synchronized with an NTP service. If you use a UK-based CDN, whitelist the /wp-json/ endpoint and never cache POST requests. Consider testing your site with the REST API log to monitor nonce expiry. Finally, schedule regular maintenance – updates, cache purges, and nonce regeneration – to keep your WordPress site humming for UK visitors.
FAQ
Gutenberg relies heavily on REST API requests to autosave and fetch content. The error usually means your nonce has expired or the user session token was lost. Log out and log back in, then clear all caches. If it continues, your server time may be incorrect; set it to UTC or London time so WordPress can calculate nonce expiry accurately.