Fix the WordPress REST API Authorization header

The symptom

You connect WordPress with a correct username:application_password, but every REST write fails and a test returns: {"code":"rest_not_logged_in","message":"You are not currently logged in."} with HTTP 401, even though the same credential works in wp-admin.

The cause

WordPress Application Passwords authenticate using the HTTP Authorization header. Many hosts, Hostinger, and Apache/LiteSpeed with CGI/FastCGI, strip that header before it reaches PHP, so WordPress sees the request as anonymous. A quick tell: send a deliberately WRONG password and you get the exact same rest_not_logged_in error. If wrong and right passwords fail identically, the header is being stripped.

Fix 1, pass the header through .htaccess

Edit .htaccess in your WordPress root (usually public_html). In your host's File Manager, enable “show hidden files” to see it. Add this at the very top, above # BEGIN WordPress:

CGIPassAuth On
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [E=HTTP_AUTHORIZATION:%1]
</IfModule>
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

CGIPassAuth On is the LiteSpeed/Apache 2.4.13+ directive that forwards the Authorization header to PHP; the rewrite lines cover Apache setups that don't honor it. Save, then re-test the connection.

Fix 2, disable / bypass the CDN

If a CDN sits in front of your origin (Hostinger's built-in CDN reports server: hcdn), it can strip the Authorization header before .htaccess ever runs. In your host panel, find the CDN setting (Hostinger: hPanel → Websites → your site → Performance → CDN), turn it OFF, and purge the cache. Re-test.

Fix 3, the secret-endpoint plugin (works even when the header is stripped)

If the header is stripped at the CDN edge and you can't disable the CDN, no server config can recover it, so route around it. A tiny must-use plugin adds a REST endpoint that takes a shared secret in the request BODY (which CDNs pass through), instead of the Authorization header. See the dedicated guide “Install the Nexus Apply plugin”.

• It sets image alt text (update_post_meta) and creates draft blog posts (wp_insert_post) with a featured image and FAQ schema, nothing else.
• It's locked to a random secret you generate.
• You can delete the file any time to close the endpoint.

Verify it worked

Re-run the CMS connection test (or the audit's apply). Success looks like a 200 with your user and roles returned. If you still get 401 after Fixes 1-2, use Fix 3; if you get 403, the account isn't an Administrator/Editor.