Wordfence error: Unexpected token < in JSON

Wordfence sends JSON responses for admin‑ajax and REST API calls. When the server delivers an HTML document instead, the first character is ‘<', which breaks JSON.parse.

Sources include server‑level firewalls, mis‑configured .htaccess rules, PHP fatal errors, expired nonces, or aggressive Wordfence blocking. The response appears as an HTML login screen, 404 page, or security block.