Featured Image doesn’t stick

I’m unable to replicate such behavior using the same version, theme, and no plugins. Either your core WP installation has been corrupted or there’s an issue with your server configuration.

Check the site health screen for any flagged issues, especially related to the REST API and loopback requests.

Where is your dev site hosted? Some commercial hosts run modSecurity which can cause strange issues. Its configuration may need modification. Also check your .htaccess for any rules that could affect file uploads.

If you suspect your WP installation is corrupt, try manually updating, even if to the same version. The point is to refresh all files from a freshly downloaded .zip file. Manually refreshing the files is superior to the Reinstall version 6.2.2 button on the updates admin screen.

The issue started before the site was completely updated. I had “assumed” updating it might resolve the problem. It did not.

The dev site is hosted the same place as the live site.

Thank you for the suggestions. I am going to check those now and will post my findings.

I’m going through the Site Health. The “critical” issues are for Google Analytics. I disabled MonsterInsights and that went away.

This particular site does use Cloudflare and I need to find out if something changed on their end.

The “recommended improvements” include The authorization header is missing. That sounds more concerning.

All of the images being assigned as Featured Images are already on the server. When I preview before updating the image displays in the Featured Image box and also on the page. As soon as I update the image disappears.

I’m going to reach out to the host to see what they might be able to figure out.

Specifically what happens when you update is the attachement ID of the featured image is sent as part of a general POST request to the /posts/ API endpoint. The endpoint processes the submitted data and updates the DB accordingly. Part of the DB update includes setting the attachement ID as the post’s postmeta data keyed “_thumbnail_id”.

For unknown reasons this isn’t happening and any existing record is apparently blanked or otherwise corrupted. Does not actually identify what the issue is, but knowing the process can hopefully help isolate the root cause.

If this request is missing authorization information this entire process would fail. Including other changes besides featured image. Are you able to update other parts of the post when the featured image choice disappears? Authorization for API requests involves both WP auth cookie data and a valid nonce value for header X-WP-Nonce.

I hope this information might be helpful in helping you identify the root cause. Good luck.

Quick note, it’s not saving any text post changes make in “Classic Mode”.

You have given me more to dig for. Thank you!

Sorry for the delay in getting back to this (I’m recovering from a procedure for a compression fracture in my back).

To answer the question, can I update other portions of the post. It seems like I can.

I then went a looked at another WordPress installation this particular store owner has that is not hosted with his ecommerce host – it works just fine.

I think there may be another factor in play for the misbehaving installation is that it runs through Cloudflare. It’s also very obvious that it is going through Cloudflare within the admin screens as I see a message from Cloudflare telling me to “hang on”.

I am going to ask the host if they can disable Clodeflare from the dev installation I set up. If the Featured Image “sticks” with it disabled I may have found the culprit. If not, then I need to go back to the health issue “Authorization header comes from the third-party applications you approve. Without it, those apps cannot connect to your site.” – how do I even figure out what apps need this?

I’m sorry to hear of your back issues, I hope recovery is as quick and with as little pain as possible.

Don’t worry about third party apps. The error message is generic and thus misleading in your case. The message is assuming external apps will access the API, but in your case it’s WP itself. When WP makes an API request, it sends an auth cookie and a verification nonce. There is normally no actual Authorization: header sent. There are other methods of API authentication that use Authorization:, but not the default cookie method.

The site health’s authorization check involves site health acting like a third party app in sending an API request that does involve Authorization:. While this is certainly an issue, I’m unsure if it relates to featured images and cookie authentication. Apparently Cloudflare is maybe stripping out certain header data when it relays requests to your site? It’s then plausible that it could be stripping out other important data that the API requires to set a featured image.

If removing Cloudflare does not resolve the problem, my best guess at the culprit would the server’s modSecurity configuration. Assuming it has such a module.

FYI, the server does not use modSecurity. I am still waiting on my request for them to disable Cloudflare.