Error map
XML-RPC server accepts POST requests only WordPress: XML-RPC server accepts POST requests only (xmlrpc.php)
WordPress · layer 4, Application & API
Centre: this error. First ring: errors it is linked with (9). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (9)
WordPress: Sorry, you are not allowed to upload this file type / Sorry, this file type is not permitted for security reasons
WordPress blocked the upload because the file extension/MIME type isn’t in its allowed list (SVG, JSON, WEBP on old versions, fon…
WordPress: 403 Forbidden on wp-admin, wp-login.php or admin-ajax.php
The server or a security layer refused access to WordPress admin URLs — file permissions, a security plugin/WAF rule, ModSecurity…
WordPress: Are you sure you want to do this? Please try again. (nonce check failed)
A WordPress security nonce didn’t validate — the page was open too long, cached, or a plugin/theme form is broken.
AADSTS50053: Your account is locked (Smart Lockout) / sign-in blocked due to suspicious activity
Too many failed sign-ins (or sign-ins from a malicious IP) triggered Entra Smart Lockout.
Webhook signature verification failed (Stripe, Razorpay, GitHub…)
Your endpoint computed a different HMAC signature than the one the provider sent, so the webhook is rejected.
java.lang.SecurityException: Permission Denial ... requires android.permission.X
The app called an API that needs a permission it hasn’t declared or the user hasn’t granted at runtime.
macOS: “App” is damaged and can’t be opened. You should move it to the Trash.
Gatekeeper blocked an app that isn’t properly signed/notarized or was modified after download (quarantine attribute).
ForbiddenError: invalid csrf token (EBADCSRFTOKEN)
The request’s CSRF token is missing or doesn’t match the token tied to the user’s session/cookie.
HTTP 405 Method Not Allowed
The URL exists, but it doesn’t accept the HTTP method you used (e.g. POST to a GET-only route).
Two steps away (27)
WordPress: The link you followed has expired
Usually an upload (theme, plugin, media) larger than PHP’s upload/post limits — WordPress receives an empty request and shows thi…
NotAllowedError: play() failed because the user didn't interact with the document first.
The browser blocked media autoplay with sound until the user interacts with the page.
Upload error: File type not allowed / unsupported file type
The upload was rejected because the file’s type — extension, MIME type or actual content — isn’t on the allowed list.
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
WordPress: Sorry, you are not allowed to access this page.
Your user role lacks the capability for that admin screen — or the database table prefix / user capabilities are out of sync afte…
Cloudflare Error 1020: Access Denied
A Cloudflare firewall/WAF custom rule blocked the request — the visitor’s IP, country, user agent or request pattern matched a bl…
WordPress: Updating failed. The response is not a valid JSON response.
The block editor saved via the REST API but got HTML or an error page back — broken permalinks, a security plugin/WAF, or PHP out…
WordPress login: Error: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress.
WordPress’s test cookie wasn’t returned on login — often a siteurl/home or domain mismatch, caching of wp-login.php, or headers a…
WordPress: This block contains unexpected or invalid content. Attempt Block Recovery
The saved HTML of a block doesn’t match what the block’s current save function produces — after a plugin update, manual HTML edit…
Error creating: pods is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false ...
The namespace enforces a Pod Security Standard (baseline/restricted) and the pod spec breaks one of its rules.
WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! (ssh host key changed)
The server’s SSH host key differs from the one saved in ~/.ssh/known_hosts — usually because the server was rebuilt or the IP was…
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY
apt can’t verify a repository’s signature because the repo’s signing key isn’t installed (or has expired/rotated).
HTTP 400 Bad Request
The server could not understand the request because its syntax, headers or body are malformed or invalid.
HTTP 401 Unauthorized
The request has no valid authentication credentials — you need to log in or send a valid token.
AWS: SignatureDoesNotMatch / InvalidClientTokenId — the request signature we calculated does not match
AWS rejected the request signature — wrong secret key, wrong region, clock skew, or a presigned URL used differently from how it…
npm ERR! code EACCES — permission denied
npm can’t write to a directory — usually global installs into a root-owned folder.
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
The docker CLI can’t talk to the Docker engine — it isn’t running, or your user can’t access the socket.
OAuth 2.0 Error: invalid_scope / insufficient_scope
The requested scope is unknown or not allowed for this client — or the token lacks the scope the API endpoint requires.
SELinux is preventing ... / avc: denied { read } for pid=... (permission denied despite correct permissions)
SELinux blocked the access — file permissions look fine, but the file’s security context or a boolean doesn’t allow the service t…
Cloudflare Error 1005: Access denied — The owner of this website has banned the autonomous system number (ASN) your IP address is in
The site owner blocked your network provider (ASN) — common for VPNs, cloud/data-center IPs and some mobile carriers.
Cloudflare Error 1006 / 1007 / 1008: Access denied — Your IP address has been banned
The site owner (or a Cloudflare security setting) blocked your IP address.
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
Warning: session_start(): Session cannot be started after headers have already been sent
session_start() ran after output was sent, so PHP can’t set the session cookie.
Warning: session_start(): open(/var/lib/php/sessions/sess_x, O_RDWR) failed: Permission denied
PHP can’t write session files to the configured session.save_path.
HTTP 404 Not Found
The server can’t find anything at the requested URL.
CORS Error: No 'Access-Control-Allow-Origin' header is present
The browser blocked a cross-origin request because the server’s response didn’t include the CORS headers allowing your site’s ori…
HTTP 501 Not Implemented
The server doesn’t support the functionality (usually the HTTP method) needed to fulfil the request.
Map another error
Popular: 4035004000xC000007BTypeErrorCritical error404NullPointerException