WordPress troubleshooting

"Authentication failed" on test connection

Some hosts and security plugins (iThemes Security, Wordfence with strict mode) disable Application Passwords. Symptoms:

• Test connection answers Authentication failed. Check user + Application Password.
• The Application Passwords section is missing from the user's profile in wp-admin.

Fix: enable Application Passwords. In functions.php:

add_filter('wp_is_application_passwords_available', '__return_true');

Or ask your admin to whitelist them in the security plugin. Then generate a new Application Password and open the site page in Quibo, use Update credentials in the Credentials card, and the new values are verified against your CMS before they replace the old ones.

If Application Passwords are enabled and the test still fails, check that you pasted the login name (not the display name or the email) and the full 24-character password.

"401" or "403" on publish

The Application Password was revoked, the user it belongs to was removed or demoted, or a bot-protection layer blocks /wp-json/ calls from outside. The WordPress response is shown in the article's error message.

A failed publish stays on its scheduled date, marked Publish failed (it sits in the Ready column). Quibo retries temporary errors automatically when they come before the post is created: a site that cannot be reached, rate limits, maintenance mode, and a cover image upload that failed or timed out. A timeout or a server error after the article was sent is not retried blindly, because the post may already exist: Quibo first checks your site for it (see the next section). The organization owner gets an email if the article still cannot be published. Fix the cause, then click Publish now or pick a new date.

"Checking your site"

The article was sent, but WordPress did not confirm it: the request timed out, or WordPress answered with a server error that is not a maintenance page. Behind a caching proxy, WordPress often keeps saving the post after the proxy gave up, so the post may be on your site already.

What Quibo does: the article stays Scheduled, marked Checking your site. At least 5 minutes later Quibo reads your posts with the same Application Password (GET /wp-json/wp/v2/posts, unpublished, scheduled, pending and private posts included) and looks for one whose slug is the article's slug or that slug with "-2" to "-5" (WordPress adds these when a slug is taken), whose title is the article's title, and which was created after the article was due. If it is there, the article is recorded as published with that post's address and nothing is posted again. If WordPress answers and it is not there, Quibo publishes the article. If WordPress does not answer, Quibo checks again at the next retry time, and after the last one asks you by email to check your site.

Fix: nothing, in most cases. If your site is fine and the check keeps failing, make sure your firewall or security plugin lets the Application Password user read /wp-json/wp/v2/posts, as it already lets it publish. If you can see the post on your site, click Mark as published on the article page and paste its address.

Fix: generate a fresh Application Password (see Connect WordPress) and save it with Update credentials on the site page, or whitelist /wp-json/wp/v2/* in your WAF. Then open the article and click Publish now, or pick a new date.

"This SVG file could not be sanitized and was rejected"

The article's error shows a failed WordPress media upload (rest_upload_sideload_error) with this text. The cover image was refused, so the post was not created and nothing was added to your media library.

Cause: the cover images Quibo generates come from the image service with embedded Content Credentials (a C2PA block that records how the image was made), and that block contains a small SVG logo. A security filter on some WordPress sites scans uploaded files for SVG code, found the logo inside an ordinary PNG and rejected the whole file.

Fix: none needed on your site. Quibo now removes that block from every cover; the pixels and the AI-generated marking (XMP metadata) stay. Open the article and click Publish now, or pick a new date. If the same message comes back, email support@quibo.cc with the article link and, if you know it, the plugin or snippet that shows this message.

"rest_no_route" on publish

Your WordPress instance is on a very old version (before 5.6) that doesn't have Application Passwords, or the REST API is disabled by a plugin.

Fix: upgrade WordPress, or re-enable the REST API.

Posts publish but don't show on the front page

Check the status of the post in wp-admin, Posts. We POST with status: publish. If you see draft or pending, your theme or a plugin is intercepting and downgrading. Disable plugins one by one to find the culprit, or give the user the Editor or Administrator role.

Cover images appear without alt text

The alt text is sent in a second call right after the upload. A few hosts strip that call. Check wp-admin, Media, your image, Alt text. Edit if empty.

SEO title or meta description isn't updating

Quibo writes the SEO title and meta description fields of Jetpack SEO, Yoast SEO (27.7 or later) and SEOPress, and stores the meta description as the post excerpt. See Connect WordPress for the exact fields.

• Yoast before 27.7 does not accept these fields from the REST API. Update Yoast.
• Rank Math and All in One SEO: Quibo does not write their title field. The description reaches them through the post excerpt, where their description template uses it.
• Jetpack SEO: the SEO title is set only when the article has its own meta title; otherwise Jetpack applies your title format. Jetpack also turns its SEO fields off while another SEO plugin is active.

Structured data (JSON-LD) is missing from the post

WordPress keeps the <script type="application/ld+json"> tag only when the user behind the Application Password has the unfiltered_html capability. Without it WordPress removes the tag, and Quibo removes the leftover block so no raw JSON shows to readers.

Fix: connect with an Administrator or Editor on a single-site install. On a multisite network only Super Admins have the capability. Also check that wp-config.php does not set DISALLOW_UNFILTERED_HTML. Articles published after the change keep their structured data.

Author is wrong

The Default author in your brand profile is matched against the users found at connection time. If none is saved, WordPress attributes the post to the user that owns the Application Password. Click Re-crawl brand on the site page to refresh the user list, then pick the author and click Save brand profile.

Still stuck?

Email support@quibo.cc with the organization ID shown in Settings, Account. Business plans get priority routing, with a typical response under 8 business hours.

If you'd rather start clean: connecting a fresh test site for 5 minutes is faster than debugging your prod site. Connect a new site