“Updating failed. The response is not a valid JSON response.”

The block editor saves through the WordPress REST API and expects a JSON response. The message means the response came back in the wrong format, for example as an error page, a redirect or a firewall's block page. The cause can be the permalinks, a firewall, the site address or a plugin that sends invalid JSON.

Check Site Health first

Go to Tools → Site Health. If it says "The REST API encountered an error", the problem is in the REST API, not in your post. Expand the message to see the status code the server returned:

• 404 means the REST API address doesn't exist because the permalink rewrite rules are missing.
• 403 means something blocks the request, for example a firewall or a plugin that disables the REST API.
• 500 means PHP stopped with a fatal error in a plugin, the theme or WordPress itself.

The test runs from the server itself, so a firewall that only blocks your browser doesn't show up here.

See what the server returned

Your browser's developer tools show the response that triggered the error:

1. Press F12 and open the Network tab.
2. Save the post again.
3. Click the request to wp-json/wp/v2/posts (or pages) and check the status code and the Response tab.

The status code and the body tell you which of the sections below applies: a firewall's block page, a 404 page, a redirect, or PHP warnings in front of the JSON data.

Save the permalinks again

If the rewrite rules are missing, this fixes the error in seconds.

1. Go to Settings → Permalinks.
2. Click "Save Changes" without changing anything.
3. Try saving the post again.

On Apache and LiteSpeed, WordPress then writes the rewrite rules to .htaccess again. If it can't write to the file, it shows the rules at the bottom of the page for you to paste in yourself. Nginx doesn't read .htaccess. There, try_files has to be in the server configuration, as shown in the article on 500 errors.

Check the site addresses

Go to Settings → General. "WordPress Address (URL)" and "Site Address (URL)" should both start with https:// if the site has an SSL certificate, and both should use the same domain, with or without www. If one of them starts with http:// while the site loads over https, or the domains differ, REST requests can be redirected or blocked by the browser.

Check the firewall

Security plugins such as Wordfence, and firewalls at your host or in Cloudflare, can block requests to /wp-json/, especially when the post contains code, scripts or long links.

1. Try saving a short post with plain text only. If that works, the firewall is reacting to the content.
2. Look for blocked requests at the time you saved, in the security plugin's log or under Security Events in Cloudflare.
3. If your host uses ModSecurity, they can see which rule fired and add an exception for it. Give them the time and the address of the post.

Check whether a plugin sends invalid JSON

If a plugin responds with PHP warnings or error messages before the JSON data, the block editor can't read the response. Deactivate the plugins one by one and try saving after each.

With the error log turned on, the PHP warnings also end up in wp-content/debug.log, with the file and line they come from. The article on the critical error shows how to turn it on.

When the error appears on upload

If the error only appears when you upload an image or another file, the web server or a firewall most likely rejected the request because the file is too large. Nginx rejects requests larger than client_max_body_size with status 413 and an HTML page instead of JSON, and Cloudflare's free plan rejects uploads over 100 MB. You can see the status code in the Network tab. If you have no access to the server configuration, your hosting provider has to raise the limit.

When you're stuck

If the post still won't save once you have checked the permalinks, the addresses and the firewall, your hosting provider has to check the error log for what happens to requests to /wp-json/. Send them the time and the status code you found in the Network tab.