Fix the WordPress REST API Authorization header

The symptom

You connect WordPress with a correct username:application_password, but every REST write fails and a test returns: {"code":"rest_not_logged_in","message":"You are not currently logged in."} with HTTP 401, even though the same credential works in wp-admin.

The cause

WordPress Application Passwords authenticate using the HTTP Authorization header. Many hosts, Hostinger, and Apache/LiteSpeed with CGI/FastCGI, strip that header before it reaches PHP, so WordPress sees the request as anonymous. A quick tell: send a deliberately WRONG password and you get the exact same rest_not_logged_in error. If wrong and right passwords fail identically, the header is being stripped.

Fix 1, pass the header through .htaccess

Edit .htaccess in your WordPress root (usually public_html). In your host's File Manager, enable “show hidden files” to see it. Add this at the very top, above # BEGIN WordPress:

CGIPassAuth On
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [E=HTTP_AUTHORIZATION:%1]
</IfModule>
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

CGIPassAuth On is the LiteSpeed/Apache 2.4.13+ directive that forwards the Authorization header to PHP; the rewrite lines cover Apache setups that don't honor it. Save, then re-test the connection.

Fix 2, disable / bypass the CDN

If a CDN sits in front of your origin (Hostinger's built-in CDN reports server: hcdn), it can strip the Authorization header before .htaccess ever runs. In your host panel, find the CDN setting (Hostinger: hPanel → Websites → your site → Performance → CDN), turn it OFF, and purge the cache. Re-test.

Fix 3, the WordPress plugin (works even when the header is stripped)

If the header is stripped at the CDN edge and you can't disable the CDN, no server config can recover it, so route around it. The WordPress plugin you download from the dashboard takes a shared secret in the request BODY (which CDNs pass through) instead of the Authorization header, and it is the recommended way to connect in any case. See “Install the WordPress plugin”.

• It applies approved fixes and publishes draft articles, nothing else.
• It's locked to a random secret generated for your project.
• Deactivate it any time to close the endpoints.

Verify it worked

Re-run the CMS connection test (or the audit's apply). Success looks like a 200 with your user and roles returned. If you still get 401 after Fixes 1-2, use Fix 3; if you get 403, the account isn't an Administrator/Editor.