Wordpress Application Credentials stopped working

[paulo.tihee]

Describe the problem/error/question

WordPress API credentials suddenly stopped working. They were fine for many months. Before anyone comments, I’m using the application password and not the regular password to connect.

What is the error message (if any)?

Information on your n8n setup

• **n8n version: 1.99.1
• **Database (default: SQLite): SQLite
• **n8n EXECUTIONS_PROCESS setting (default: own, main): own
• **Running n8n via (Docker, npm, n8n cloud, desktop app): n8n cloud
• **Operating system: n/a

[paulo.tihee]

@zynate

7. Test the Credential:

• Use the HTTP Request node with Basic Auth to confirm credentials work:

Method: GET
URL: https://yourdomain.com/wp-json/wp/v2/users/me
Authentication: Basic Auth
Username: your_username
Password: application_password

---

It works fine through Postman, but I’m getting 403 with a HTTP Request Node

[zynate]

1. Switch your HTTP Request node to true “Basic Auth” mode

• In “Authentication” choose Basic Auth (not “Generic Credential”)
• Enter your WordPress username and application password in the dedicated fields
• Leave Send Query Parameters and Send Headers off

2. Disable redirect-following (WordPress sometimes returns a 302→login page before the 403)

• Under Options, set Follow Redirects to Off

3. Re-run the node

• You should now see a clean 200 with your user JSON rather than the Cloudflare/WordPress HTML challenge

By using the built-in Basic Auth mode (which pre-sends the Authorization: Basic ... header) and preventing the HTTP client from auto-following the 302→login redirect, you’ll avoid the 403 HTML page and get the proper API response.

[paulo.tihee]

@zynate

1. Switch your HTTP Request node to true “Basic Auth” mode

• In “Authentication” choose Basic Auth (not “Generic Credential”)

There are only 2 options for Authentication: Predefined Credential Type and Generic Credential Type

Basic Auth option is available only on the Generic Credential Type

I switched to Predefined and chose WordPress API.

neither works

@zynate

2. Disable redirect-following (WordPress sometimes returns a 302→login page before the 403)

• Under Options, set Follow Redirects to Off

Done, but still not working

[paulo.tihee]

Found the issue: Cloudflare bot detection

[Mtrl_Scientist]

Can confirm: it’s bot-detection.

Though not necessarily Cloudflare. Sometimes your own hoster will think you’re a bot and block you.