Cornerstone document endpoint returns 401 for a WordPress Administrator

[lorenzo]

Cornerstone 7.9.0 will not load the builder document for our Home page (WordPress page ID 85). The request to /wp-json/themeco/data/document/85?_wp_nonce=…&_locale=user returns 401 rest_forbidden with “Sorry, you are not allowed to do that.”

The user is a standard WordPress Administrator. In Cornerstone → Settings → Permissions, Administrator is enabled for Pages, Layouts, Components, Elements, Templates, Global, and Preferences. We re-authenticated, saved permissions, cleared Cornerstone cache, and purged SiteGround cache. The result remains the same.

The normal WordPress editor can save the post, but Cornerstone continues to render its prior builder document. What Cornerstone-specific permission, REST rule, or known conflict should we repair? Please advise the supported fix. We can provide a secure note with access if needed.

[ruenel]

Hey @Lorenzo,

Thanks for writing in!

That endpoint’s permission check is simply whether a user is logged in; it does not consult the Cornerstone permission settings at all. So the Pages, Layouts, Components and Templates toggles you enabled are not involved here, and no further changes are needed in that panel.

A 401 rest_forbidden means WordPress did not recognise the request as authenticated. WordPress returns 401 for “not logged in” and 403 for “logged in but not permitted”, so this is an authentication failure rather than a permissions one. The usual cause is an expired or stale security nonce, or session cookies not reaching the REST endpoint.

1. Test WordPress authentication directly – while logged in, open https://your-site.com/wp-json/wp/v2/users/me in the same browser. If it returns your user details, authentication is working and the problem is limited to the builder request. If it also returns 401, the issue is site-wide and not specific to Cornerstone. Please tell us which you see, as this determines everything that follows.

2. Force a fresh nonce – security nonces expire after roughly 24 hours, so a builder tab left open overnight will fail this way. Log out fully, close the tab, log back in and open the builder directly rather than reloading an existing tab.

3. Exclude the dashboard from caching – on SiteGround, please confirm that Dynamic Caching and any CDN are not caching /wp-admin or logged-in requests. A cached admin page will serve an expired nonce even after the cache is purged.

4. Check your address consistency – confirm that Settings > General uses the same scheme and hostname you browse with, including www or non-www. A mismatch prevents login cookies from being sent to the REST endpoint.

If the issue persists, please provide the result of step 1, your System Info (WP Admin > Cornerstone > System Info), and confirm whether any security plugin such as SiteGround Security is active, as these can filter REST API authentication.

Best Regards.