An Intermittent REST API Timeout Can Point to a Correct Rule That Hasn’t Actually Applied Yet
⚡ Quick Fix (TL;DR)
The Culprit: Site Health's REST API check (cURL error 28: Operation timed out) kept flapping between clear and broken over several hours — even after adding a Sucuri WAF allowlist rule for /wp-json/. The rule saved without error and looked correct, but the timeout kept returning on its own unpredictable schedule.
The Fix: The rule itself wasn't wrong — it just hadn't been picked up cleanly by the firewall's rule engine. Toggling Sucuri's firewall off, then back on, forced a full rule reload, and the timeout stopped recurring afterward. A saved WAF/CDN rule isn't guaranteed to be "live" the instant it's saved; if a fix looks correct on paper but the symptom keeps intermittently returning, cycling the security layer off and on is worth trying before concluding the rule itself is wrong.
Tagged in :
More from the field
Bisect to an Empty Baseline Before Trusting Any Single Theory
.
Multiple plausible-sounding theories for a bug each turned out to be wrong when actually tested – time was spent building fixes…
A Security Dashboard’s Activity Log Can Lag a Full Day Behind Real Time
.
Trying to check a security tool’s activity log for an event that had just happened showed nothing at all.