Blocked due to other 4xx issue

Where you see it: Search Console → Indexing → Pages → Why pages aren’t indexed

Googlebot requested this URL and your server answered with a 4xx error code that has no row of its own in the report, unlike 401, 403 and 404. Codes such as 400 Bad Request, 405 Method Not Allowed or 451 land here. Google won’t index a URL while it answers 4xx, so the question is whether the code was meant for Googlebot.

Fix it if the page should be in Google; leave it if the code is deliberate.

Find the code and who sends it. WordPress itself answers 400 or 405 at addresses that were never pages, such as admin-ajax.php and xmlrpc.php, and a 451 you set for a legal takedown is correct. A firewall’s 4xx on a post you want indexed keeps it out of search until the rule changes.

Check a URL now Can RankHive fix it? No

Check the URL Search Console listed

Paste the URL from the report. The redirect checker prints the status code at each hop, so you see the exact 4xx and whether a redirect target sends it. It identifies itself as RankHiveTools, not Googlebot, so a firewall may treat it differently.

Redirect report

Enter a URL to see every hop it passes through, with the status code at each step.

Reading the result

Final status 400: the request was refused as malformed. On admin-ajax.php or a /wp-json/ address, that is WordPress; on a post, look for a mangled URL or a firewall rule.
Final status 405: the address accepts only POST, as wp-comments-post.php and xmlrpc.php do. Normal for those two; on a post, ask your host.
Final status 451: a redirect plugin or firewall rule marks the page as legally unavailable. Leave it if you set it.
The chain ends on HTTP 4xx after a redirect: the listed URL redirects into an error. Fix the rule’s target, not the original address.
Final status 200: the URL works for the checker. The error was temporary or aimed at Googlebot alone; run Test live URL before changing anything.

The same tool with its full guide: Redirect Checker

Why it happens on WordPress

This label is a catch-all, so start from the code. On WordPress it usually comes from a core file that was never a page, a plugin sending a code on purpose, or a security layer that disliked the request.

Core files that only take submissions

The comment form on every post with comments open submits to /wp-comments-post.php, and xmlrpc.php ships with every WordPress install. Core answers a GET to either with 405 Method Not Allowed and an Allow: POST header. If Google requests one, it lands here, and no page is missing.

admin-ajax.php called without an action

WordPress’s default robots.txt disallows /wp-admin/ but allows /wp-admin/admin-ajax.php, and a request to that file without the action a plugin would send gets a 400. Its address sits in scripts on many WordPress pages, so Google can find it. That is normal.

REST API routes asked for the wrong thing

WordPress links its REST API, under /wp-json/, from the head of every page, and plugins add routes of their own. A route answers 400 with a JSON error, rest_missing_callback_param or rest_invalid_param, when a required parameter is missing or fails its checks. A cut-off /wp-json/ address can produce either.

A 451 for content removed on legal grounds

Rank Math’s Redirections module and Yoast SEO Premium’s redirect manager both offer a 451 rule, for a page taken down after a court order or takedown notice. The Redirection plugin can also answer a URL with an error code. A 451 you chose is deliberate.

Firewall rules with a custom response code

A host firewall or security plugin can refuse a request over an odd query string, a long tracking parameter or a country. A Cloudflare custom rule’s Block action answers 403 by default, but its custom response can use any code from 400 to 499. Wordfence’s firewall rules answer 403, which has its own row; for its IP blocklist, country blocking and rate limiting it serves its own block page, so check the status the redirect checker reports.

Malformed URLs picked up elsewhere

URLs with broken encoding or cut-off parameters, picked up from scrapers, bad links or code Google parsed, get 400 Bad Request. If they look mangled and you never linked to them, they are harmless.

How to fix it

Read the code, find who sends it, decide whether Googlebot should get it.

1. Read the exact code
Run Test live URL in URL Inspection to see what Google gets today, and the redirect checker for the status number. If both succeed, the error was temporary and clears on recrawl.
2. Work out which layer answered
Look at the error page itself. A Cloudflare error page names Cloudflare and shows a Ray ID; a host firewall page usually names the host; an error inside your theme’s design came from WordPress or a plugin.
3. Leave WordPress’s own endpoints alone
admin-ajax.php answering 400, wp-comments-post.php and xmlrpc.php answering 405, and /wp-json/ routes rejecting a bare request are WordPress working as built, and none is a page. Don’t block admin-ajax.php in robots.txt: core’s default robots.txt allows it on purpose.
4. Keep a deliberate 451, and stop pointing at it
A 451 on a legally restricted page is the right answer. Check that your menus, posts and XML sitemap no longer link to it.
5. Relax a firewall rule that misfires
If a firewall answers real pages with a 4xx, find the request in its log, note the rule that matched, and add an exception for that path or parameter.
- Cloudflare: bot and WAF rules can challenge crawlers as well as block them. Filter Security Events for Googlebot or Bingbot requests and change the rule that acted.
- Wordfence: Live Traffic lists blocked requests with the reason for each block.
- Host firewall: send your host the URL and the crawl time URL Inspection shows.
6. Point redirects past the error
When a redirect ends on a 4xx, edit the rule so it lands on a live page, and update post links that still use the old address. Mangled URLs nobody links to can stay.

Where each 4xx code ends up

Search Console gives common codes their own rows and collects the rest here.

Code	Usual source on WordPress	Where Search Console lists it
404 Not Found	Deleted, unpublished or renamed content	Not found (404)
401 Unauthorized	HTTP authentication on staging or a folder	Blocked due to unauthorized request (401)
403 Forbidden	Firewall rules, CDN bot rules, security plugins	Blocked due to access forbidden (403)
400 Bad Request	admin-ajax.php, REST API routes, malformed URLs, firewalls	This status
405 Method Not Allowed	A GET request to wp-comments-post.php or xmlrpc.php	This status
451 Unavailable For Legal Reasons	A legal-takedown rule in a redirect plugin or firewall	This status

Check the fix in Search Console

Confirm from Google’s side: a firewall can treat Googlebot differently from your browser.

Run Test live URL on a page you want indexed. It should fetch successfully and show the page in the screenshot.
Validation passes only if no URL Google rechecks still answers a 4xx, and stops with Failed at the first one that does. xmlrpc.php, admin-ajax.php and a 451 you keep never change.
If every listed URL was a page you fixed, open this status in Indexing → Pages and click Validate fix. Google’s help allows around two weeks for most runs, and some take longer.
If the list mixes fixed pages with endpoints or deliberate codes, don’t validate; each URL updates as Google recrawls it.
After relaxing a firewall rule, watch Settings → Crawl stats for a few days: the share of 4xx responses should fall.

Can RankHive fix this?

No, in most cases: these codes come from WordPress’s own endpoints, firewalls, hosts and other plugins’ rules, which RankHive doesn’t change. It can fix links in your posts and pages that lead to a URL answering 4xx.

What it writes, once you approve

Internal links in post and page content repointed to a live page when they lead to a URL that answers 4xx.
An exact-path 301 for a removed post’s address, once no other plugin rule answers that URL.

What it can’t do here

Change Cloudflare, host firewall or security-plugin rules.
Edit or remove 451 rules in Rank Math, Yoast SEO Premium or Redirection, or send a 451 itself.
Change what admin-ajax.php, xmlrpc.php, wp-comments-post.php or REST API routes answer.
See this status as a list in Search Console or validate it; it only inspects your URLs, read-only.

Every change is drafted next to the current value and waits for your approval. Each one written is logged in the Change Log, with Revert.

Check the rest of your site while you’re here

The free site check reads your public pages for titles, meta descriptions, headings, canonical tags and schema, and shows what needs fixing. If you sign up, RankHive reads your Google Search Console data every week, drafts the fixes, and writes the ones you approve to WordPress. Nothing changes on your site until you say yes.

Related issues

Common questions

What does “Blocked due to other 4xx issue” mean?

Your server answered Googlebot with a 4xx error code other than 401, 403 or 404, which each have their own status. Google won’t index the URL while it returns that code.

Why is admin-ajax.php listed under this status?

Googlebot requested /wp-admin/admin-ajax.php without the action a plugin would send, and WordPress answers that with 400. Leave it; the default robots.txt allows the file deliberately.

Is it a problem that xmlrpc.php or wp-comments-post.php is listed?

No. Both accept only POST requests, so WordPress answers Googlebot’s GET with 405 Method Not Allowed. Neither is a page, so nothing is missing from search.

Why does the page load fine for me?

A firewall rule may match Googlebot’s user agent, IP range or country, and your browser carries cookies. URL Inspection’s live test fetches as Google.

Sources

Checked against these pages on 17 October 2026.