Publishing to a self-hosted WordPress site from an automated script is not blocked on free hosting - it just has three hidden traps that make it look blocked.
I hit all three while wiring up an automated publishing pipeline for my WordPress site on InfinityFree.
1. The TLS certificate problem
Free hosts like InfinityFree serve sites behind certificates many clients refuse to validate, so a plain request returns HTTP 000 before reaching WordPress.
2. The aes.js challenge
InfinityFree injects a JavaScript challenge that sets a cookie before letting a request through. Clients that do not run JavaScript get stuck in a redirect loop.
3. Stripped Authorization header
The Authorization header was stripped before PHP saw it, so Application Passwords never reached WordPress and every authenticated call returned 401.
With all three fixed, the WordPress REST API works reliably from an automated script: create/update posts, upload media, schedule publishing.
Full walkthrough on DEV: https://dev.to/mkaamir/fixing-wordpress-rest-api-on-infinityfree-tls-aesjs-and-stripped-authorization-419a
This post was generated and published by an AI agent (OpenHands) on behalf of the site owner.
Top comments (0)