# Authorization header stripped by your web server

> Royal MCP returns 401 on every request because your web server drops the Authorization header. One line in .htaccess or nginx passes it through.

- Canonical: <https://royalplugins.com/support/royal-mcp/authorization-header-stripped/>
- HTML version: <https://royalplugins.com/support/royal-mcp/authorization-header-stripped/>

---

AI clients sign in to Royal MCP by sending a key or token in the `Authorization` header. Some web servers drop that header before WordPress sees it, so **every signed-in request fails with 401 Unauthorized**, even with a key you just copied. It is a server setting, not a Royal MCP setting, and one line in `.htaccess` (Apache, LiteSpeed) or in your nginx config fixes it.

### Detected by Royal MCP’s own check

If you came here from the “Your web server is stripping Authorization headers” notice, or from a failed **Test connection**, your site has already sent itself a test request with an `Authorization` header and WordPress did not receive it. Jump to [the Apache fix](#apache) or [the nginx fix](#nginx).

## What you see

- Every request from Claude, ChatGPT, Cursor or another AI client returns `401 Unauthorized`, with an API key or an OAuth sign-in that just worked.
- OAuth sign-in completes in the browser, then the first tool call fails.
- A red Royal MCP notice in wp-admin: “Your web server is stripping Authorization headers before WordPress receives them.”
- On Royal MCP Pro, **Test connection** on the dashboard shows “The Authorization header reaches WordPress” as failed.

## Why it happens

When Apache runs PHP through CGI or FastCGI (PHP-FPM), it does not hand the `Authorization` header to PHP unless a rule tells it to. WordPress writes that rule into its own `.htaccess` block, so it goes missing when the file was written by an old WordPress version, replaced by a custom one, or cannot be written. nginx normally passes the header, but a custom server config, or a proxy, load balancer or firewall in front of the server, can drop it.

Either way WordPress sees a request with no credentials, and Royal MCP answers 401.

## Fix on Apache or LiteSpeed (.htaccess)

Most shared hosts (cPanel, Plesk, LiteSpeed) read `.htaccess`. You can edit it with your host’s file manager, SFTP or SSH.

#### Step 1: Save your permalinks

In wp-admin go to **Settings → Permalinks** and click **Save Changes** without changing anything. WordPress rewrites its `.htaccess` block, which includes a line that passes the header. Then [check the fix](#verify). If it still fails, or WordPress says it could not write `.htaccess`, carry on.

#### Step 2: Open .htaccess in your WordPress folder

It sits next to `wp-config.php`. File managers often hide files that start with a dot; turn on “Show hidden files”. Make a copy first so you can put it back.

#### Step 3: Add this line above `# BEGIN WordPress`

```
# Pass the Authorization header to WordPress (Royal MCP)
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
```

Keep it above the `# BEGIN WordPress` block: WordPress rewrites everything between its own markers when permalinks are saved.

#### Step 4: If that line is not enough

On Apache 2.4.13 or later you can use this instead, in the same place:

```
CGIPassAuth On
```

If the site shows a 500 error after the edit, your host does not allow that directive in `.htaccess`: restore your copy and ask your host to pass the header (see [the message to send](#ask-host)).

## Fix on nginx

nginx does not read `.htaccess`. To make sure the header reaches PHP, add one line where nginx hands PHP requests to PHP-FPM, usually the `location ~ \.php$` block of your site’s server config:

```
fastcgi_param HTTP_AUTHORIZATION $http_authorization;
```

Then test the config and reload nginx:

```
sudo nginx -t && sudo systemctl reload nginx
```

Managed hosting on nginx

On managed hosts you usually cannot edit the server config yourself. Send your host the message below; it is a one-line change on their side. If a proxy, load balancer or firewall sits in front of the site, ask whoever runs it to pass the `Authorization` header through as well.

## Message to send your host

If you cannot edit the config, paste this into a support ticket:

```
Hello, my WordPress site needs the HTTP Authorization
header passed through to PHP. Requests to /wp-json/ with
"Authorization: Bearer ..." reach WordPress without it.

Apache:
  SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
  (or CGIPassAuth On)
nginx:
  fastcgi_param HTTP_AUTHORIZATION $http_authorization;

If a proxy or firewall sits in front of the site, please make
sure it passes the Authorization header too.

Could you enable this for my site? Thank you.
```

## Check the fix

1. **Royal MCP Pro:** open **Royal MCP Pro → Dashboard** and click **Test connection**. “The Authorization header reaches WordPress” should pass. The check runs on the spot.
2. **Royal MCP (free):** the notice checks again on its own within 12 hours. To check now with WP-CLI, run the command below, then open the **Plugins** page; the notice should not come back.

```
wp transient delete royal_mcp_auth_header_status
```

Then reconnect your AI client. If it signed in with OAuth before the fix, sign in again so it gets a fresh token.

## Still stuck? Two support paths

If the header now reaches WordPress and requests still fail, the cause is elsewhere. Start with the [troubleshooting playbook](https://royalplugins.com/support/royal-mcp/troubleshooting-start-here/).

### Community support (free): wp.org plugin forum

Post a new thread at [wordpress.org/support/plugin/royal-mcp/](https://wordpress.org/support/plugin/royal-mcp/). The Royal Plugins team monitors the forum regularly.

### Premium support (paid)

For direct one-on-one help with 24-hour SLA, see [Premium Support](https://royalplugins.com/premium-support/) ($149/year).

#### Information to include (either path)

- Your hosting provider and whether the server runs Apache, LiteSpeed or nginx
- The Test connection results (Royal MCP Pro) or the exact admin notice text
- What you added and where (`.htaccess` line or nginx block)
- Which AI client fails and the error it shows
- Royal MCP version

## More connection fixes

[Diagnose MCP with curl

Probe the endpoint from your own machine to see exactly what your server returns.](https://royalplugins.com/support/royal-mcp/diagnose-mcp-with-curl/)
[OAuth fails on managed hosts

Sign-in never starts because the host answers the discovery address before WordPress does.](https://royalplugins.com/support/royal-mcp/oauth-fails-on-managed-host/)
[API keys

Where the site API key lives, how to rotate it, and how AI clients send it.](https://royalplugins.com/support/royal-mcp/api-keys/)

[Back to Troubleshooting Start Here](https://royalplugins.com/support/royal-mcp/troubleshooting-start-here/)
[Royal MCP Support Hub](https://royalplugins.com/support/royal-mcp/)