What this problem looks like
WordPress admin relies on AJAX for autosave, media uploads, and plugin settings. A 400 response often means bad nonce or blocked request. A 500 response means a PHP fatal error in a plugin hook during the AJAX action.
Start in browser DevTools Network tab. The response body often contains -1 for failed nonce or a PHP error string when WP_DEBUG_DISPLAY is on in staging.
Step 1: Inspect admin-ajax.php in DevTools
In Chrome or Firefox, open DevTools → Network. Trigger the broken action, filter by admin-ajax.php, and click the request. Check Status, Response, and Payload tabs.
- A 403 error: security plugin or host firewall blocking POST.
- A 500 error: PHP fatal error in a plugin handling the action.
- 200 with body
-1: nonce or cookie/session problem. - 0 or failed: mixed content or wrong admin URL.
Step 2: Enable logging for AJAX fatals
Open wp-config.php in your site root, next to wp-admin and wp-content. Search for WP_DEBUG, WP_DEBUG_LOG, and WP_DEBUG_DISPLAY first. If those lines already exist, set them to the values below instead of adding duplicates. If none of them exist, paste them above the stop editing line. Reproduce the action, then check wp-content/debug.log immediately after.
define( 'WP_DEBUG', true );
define( 'WP_DEBUG_LOG', true );
define( 'WP_DEBUG_DISPLAY', false );
define( 'SCRIPT_DEBUG', true );Step 3: Re-save permalinks and clear cache
Go to Settings → Permalinks in wp-admin and click Save without changes. This regenerates rewrite rules that admin-ajax.php relies on. Clear object cache, page cache, and CDN cache after URL or SSL changes.
Step 4: Test for plugin conflicts
Rename wp-content/plugins to plugins.disabled via File Manager, SFTP, or FTP. If AJAX works, rename plugins.disabled back to plugins, then activate plugins one at a time in wp-admin. Deactivate caching, security, and optimisation plugins first; they hook early into admin-ajax.php. If using Query Monitor on staging, watch ajax hooks for slow or failing callbacks.
The commands below need SSH access and will not work inside File Manager:
wp plugin deactivate --all
wp plugin activate woocommerceStep 5: Fix security and CORS blocks
If a security plugin blocks admin-ajax.php, whitelist /wp-admin/admin-ajax.php in its settings or temporarily deactivate via File Manager, SFTP, or FTP. Ensure admin loads on the same domain as siteurl, not a mismatched www variant.
When to stop DIY and hire help
AJAX failures that only happen on a live site with a full plugin stack are tedious to bisect. BugShield fixes admin-ajax.php and editor errors at a confirmed price without hourly billing surprises.