Widget JSON error

Hi,

That error — “The response is not valid JSON” — isn’t coming from GeneratePress itself. GeneratePress doesn’t hook into how block widgets save, so the theme isn’t what’s breaking it.

What that message means is that when the block widgets screen saves via the WordPress REST API, the server is sending back something that isn’t clean JSON. Usually there’s stray output (a PHP notice/warning, or interference from a security plugin, caching layer, or a server-level firewall/mod_security rule) getting mixed into the response before it reaches the browser. Classic Widgets “fixes” it because it bypasses the REST save path entirely and uses the older save method — so it’s masking the underlying issue rather than pointing at GeneratePress.

To find the real cause, could you try this on one affected site:

1. Temporarily switch to a default theme (Twenty Twenty-Four or Twenty Twenty-Five) and try saving a block widget. If the error persists, that confirms it’s not theme-related.
2. If you can reproduce it there, deactivate plugins one at a time (security and caching plugins first) and retest after each.
3. Check whether your host has a WAF or mod_security enabled — that’s a common culprit for corrupting REST responses.

Hi,

Twenty Twenty-Five (and the newer default themes) are block themes. Block themes don’t have a Widgets screen at all — the footer, sidebar, and every other region are edited as template parts inside the Site Editor. So when you switched to Twenty Twenty-Five, the error disappeared not because anything got fixed, but because there’s no block-widgets REST save happening in the first place. There’s nothing there to break.

GeneratePress is a classic theme, which is a different (and fully supported) architecture. Classic themes still use the Widgets screen, and WordPress continues to support it. Widgets have not been removed — the classic Widgets screen is still part of core, and there’s no deprecation plan for classic themes or the Widgets screen. GeneratePress isn’t outdated; it’s just built on the classic model, which WordPress maintains for backward compatibility.

So the real situation is: the block-widgets editor on your GeneratePress sites is hitting a genuine error, and it’s environment-specific (something on the server is corrupting the REST response). The fact that a block theme sidesteps it doesn’t tell us the cause — it just avoids that code path entirely.

To actually fix it on your GeneratePress sites, the next step is to reproduce it with GeneratePress active and narrow down what’s injecting output into the response. Could you tell me:

• Which host are these sites on, and do they use Cloudflare or a server-side firewall (WAF / mod_security)?
• Are any security or caching plugins active (Wordfence, iThemes/Solid Security, WP Rocket, etc.)?
• When the error happens, does the browser’s Network tab show the failed request to /wp-json/wp/v2/sidebars/...? If you open that response, it’ll usually show the stray output (a PHP warning or an HTML block) that’s breaking the JSON.

Hi,

That 403 is interesting.

The block widgets screen saves through WordPress’s Batch API — the request to /wp-json/batch/v1 in your log. Your server (nginx at Zoner) is returning a 403 with content-type: text/html for that request. So the browser sends a save, gets back an HTML error page instead of JSON, and reports “the response is not valid JSON.” Classic Widgets avoids this because it doesn’t use the Batch API at all — it saves the old way, which isn’t being blocked.

The key detail: the 403 is coming from nginx, before WordPress even fully handles the request. That means a security/firewall rule on Zoner’s side is blocking POST requests to /wp-json/batch/v1 (some managed hosts block this endpoint by default, as it’s occasionally abused). Nothing in WordPress or your theme can override a block that happens at the server layer.

The fix is on the hosting side, so I’d recommend contacting Zoner support and asking them to:

• Allow POST requests to /wp-json/batch/v1 (the WordPress Batch API endpoint), which is being blocked by a 403 at the nginx/firewall level. It’s required for the block-based widgets editor to save.

If you can, send them the same request details you sent me (the URL, the 403 status, and that it’s returning text/html from nginx) — that’ll help them locate the rule quickly.

Once they allow that endpoint, the widgets editor will save normally and you won’t need Classic Widgets. This isn’t something GeneratePress can patch, since the request is being stopped before it reaches WordPress — but it’s a straightforward server-rule change on their end.

Glad to hear that! Let us know when you hear back from them!

Hi,

That’s a good workaround — and it actually confirms what we found. The Customizer (Appearance → Customize → Widgets) saves through a different mechanism than the block widgets screen, so it doesn’t touch the blocked /wp-json/batch/v1 endpoint. Same reason Classic Widgets worked, but without needing an extra plugin — so it’s a cleaner option for now.

Worth keeping in mind: the underlying 403 block is still there, so other things that rely on the Batch API could run into it down the line. If it’s easy, it’s still worth flagging to Zoner so they can open up that endpoint — but if the Customizer covers what you need, there’s no urgency.

Glad you’ve got a working path either way.

Ok, you are welsome!