# Fix: Wordpress error "The response is not a valid JSON response when" uploading images

https://blog.cynexia.com/fix-wordpress-error-the-response-is-not-a-valid-json-response-when-uploading-images

Author: [Rob Aleck](https://blog.cynexia.com/pages/about) · https://github.com/mnbf9rca · https://www.linkedin.com/in/robertaleck/ · https://family-foqos.app/

Published: 2024-09-01
Categories: Fix


When uploading images to Wordpress, you may get this error. There are plenty of blogs online offering solutions, but they only apply to self-hosted instances - mine is hosted on just-what-i-find.onyx-sites.io/.

The error is a little pop up with the text `The response is not a valid JSON response` at the bottom of the screen when you try and upload an image:

![](https://blog.cynexia.com/attachments/fix-wordpress-error-the-response-is-not-a-valid-json-response-when-uploading-images/b5825-screenshot-2024-09-01-at-11.02.52.png)

Looking in the [developer tools console](<https://developer.chrome.com/docs/devtools/open>) on the browser shows one of two error messages:

`Failed to load resource: the server responded with a status of 403 ()` for URL `/wp-json/wp/v2/media`

or

`POST https://atomic-temporary-181991729.wpcomstaging.com/wp-json/wp/v2/media?_locale=user 403 (Forbidden)`

I have Cloudflare in front of my blog, with the OWASP filter set enabled. By examining the Security Events log (in Cloudflare at Security > Events), and adding a filter for the path `/wp-json/wp/v2/media`:

![](https://blog.cynexia.com/attachments/fix-wordpress-error-the-response-is-not-a-valid-json-response-when-uploading-images/862b7-image-3.png)

i was able to see that WAF was triggering on a specific rule, `949110: Inbound Anomaly Score Exceeded`. There are [lots](<https://community.cloudflare.com/t/wordpress-upload-false-positives-with-cloudflare-owasp-core-ruleset/288432>) [of](<https://community.cloudflare.com/t/cant-save-changes-on-wordpress-site-due-to-cloudflare-owasp-core-ruleset/453502>) [posts](<https://community.cloudflare.com/t/wordpress-upload-false-positives-with-cloudflare-owasp-core-ruleset/288432>) on the Cloudflare forum about this. One [answer from the Cloudflare team](<https://community.cloudflare.com/t/problem-uploading-a-wordpress-site-for-deployment/555085/3>) points out that the OWASP ruleset is not managed by Cloudflare - they simply integrate it in their WAF, so they have no way to tweak it. They do, however, point out you can bypass it. So I created a custom rule to match `(http.request.uri.path eq "/wp-json/wp/v2/media")`:

![](https://blog.cynexia.com/attachments/fix-wordpress-error-the-response-is-not-a-valid-json-response-when-uploading-images/611fc-image.png)

I then selected to "Skip specific rules from a Managed Ruleset", and disable rule `949110: Inbound Anomaly Score Exceeded` for this specific URI:

![](https://blog.cynexia.com/attachments/fix-wordpress-error-the-response-is-not-a-valid-json-response-when-uploading-images/88108-screenshot-2024-09-01-at-11.13.20.png)

I apply the ruleset before the OWASP one in the priority list:

![](https://blog.cynexia.com/attachments/fix-wordpress-error-the-response-is-not-a-valid-json-response-when-uploading-images/8028c-image-2.png)

And now, no more errors. Of course, this will reduce the security protection of your Wordpress instance - at least for this URI. See the [Cloudflare documentation](<https://developers.cloudflare.com/waf/managed-rules/handle-false-positives/>) for more details.