NerdyAI

Troubleshooting

Your host is blocking server requests to WordPress

Next.js loads posts on the server. Your site returns an HTML page with a JavaScript challenge (often aes.js) instead of JSON from /graphql. The server cannot run that script, so GraphQL never works until the firewall allows it.

InfinityFree (free plan)

InfinityFree applies platform-wide bot protection (JavaScript / cookie checks). It is meant for normal visitors in a browser, not for another server (Next.js, mobile apps, Python scripts) calling your WordPress API. VistaPanel does not give you a switch to disable that only for /graphql or /wp-json/.

So on the free plan, a headless setup (Next.js here + WordPress there) usually cannot work reliably. That is a product limit of free hosting, not something you can fully “fix” in code.

What actually works:

  • Move WordPress to a host that allows server-to-server HTTP to WPGraphQL (many low-cost shared plans, VPS, or managed WP hosts). Keep Next.js on Vercel and point NEXT_PUBLIC_WORDPRESS_URL at the new WordPress URL.
  • Or keep WordPress on InfinityFree and use a normal WordPress theme (no separate Next.js frontend)— visitors load the site in the browser, so bot protection is satisfied.
  • Some InfinityFree forum threads say a custom User-Agent helped REST calls in specific cases. This app already sends a browser-like User-Agent; you can override it with WORDPRESS_GRAPHQL_USER_AGENT in .env.local. It will not solve a full JavaScript challenge, but you can try a unique string (e.g. MyBlogBot/1.0) if support suggests it.

See also: InfinityFree forum — REST API / user-agent · Bot protection discussion

What you need

Unchallenged POST access to https://YOUR-DOMAIN/graphql from the machine or datacenter that runs Next.js (your laptop in dev, or Vercel in production).

Cloudflare

  1. Security → WAF → Custom rules → Create rule.
  2. Expression example: (http.request.uri.path contains "/graphql")
  3. Action: Skip → enable Super Bot Fight Mode, Browser Integrity Check, and/or Managed Challenge as needed for that request only.
  4. If you use Bot Fight Mode, consider turning it off for testing, or use the rule above so API routes are excluded.

cPanel / Imunify360 / similar

  1. Open Imunify360 (or "ModSecurity" / "Web Application Firewall").
  2. Find Graylist / Bot Protection and add your IP to the allowlist, or disable bot challenge for the site while you develop.
  3. Ask support: "Please allow server-to-server POST to /graphql without a JavaScript challenge for headless WordPress."

LiteSpeed / QUIC.cloud

In LiteSpeed ADC or QUIC.cloud dashboard, look for Anti-DDoS, captcha, or bot verification. Add an exception for /graphql or whitelist your IP.

Verify it worked

From a terminal (after the host changes), you should see JSON starting with {"data":

curl -sS -X POST "https://YOUR-DOMAIN/graphql" \
  -H "Content-Type: application/json" \
  -d "{\"query\":\"{ __typename }\"}"

Workaround (advanced)

If you cannot change the main domain, put WordPress (or only GraphQL) on a subdomain or tunnel (e.g. ngrok) that does not use the same bot filter, then set NEXT_PUBLIC_WORDPRESS_URL to that origin in .env.local.

← Back to the journal