updating failed (wp 5.0.2) when wordpress address differs from site address

Why does it differ? Those values are not arbitrary, they are determined by your configuration. You can’t just change them as you see fit.

Also, WordPress does not have a CORS policy by default. So, what do you have that is setting the Access-Control-Allow-Headers ?

They are different because I have a dns record pointing from blog.todaydata.com to todaydata.us/blog. It has always worked before the last update.

I have tried to set headers in httaccess but it did’nt do anything.

Yeah, but you have some other code that already exists that is setting that header. It is not a header WordPress sets.

The header is the problem. What is setting that incorrect header, and why?

Do you mean headers set in the theme? I tried a the theme twenty nineteen and get the same problem. Can you tell me what part of the header is incorrect? Thanks.

Your error message says it directly:

Access to fetch at ‘https://blog.todaydata.com/wp-json/wp/v2/users/?who=authors&per_page=100&_locale=user’ from origin ‘https://todaydata.us’ has been blocked by CORS policy: Request header field x-wp-nonce is not allowed by Access-Control-Allow-Headers in preflight response

WordPress sends an “Access-Control-Allow-Header” only in REST API responses, and it explicitly allows this sort of thing.

So something else on your server is sending that header. Until you figure out what, then you won’t fix the problem.

So, what plugins are you running? What else is on your server?

Wait, I just noticed that you have it set as https://blog.todaydata.com but when I go there, it gives me an invalid security certificate when it tries to force https.

That could also be a problem. I’m thinking that you probably need to fix that, or just move the site to actually be on https://todaydata.us instead of across multiple domains like that.

When I go to https://blog.todaydata.com, it is not trying to force https. It goes directly there. There is a security certificate on https://todaydata.com, not on the subdomain. I am not sure why you get the force and i don’t. As you said, this could be a clue, but the problem only arises when I try to save a draft or publish.

I have also deactivated (and then reactivated later) all plugins to ensure they could not be causing the problem.

Per where the access control header is coming from, the error message says that it is coming from
https://blog.todaydata.com/wp-json/wp/v2/users/?who=authors&per_page=100&_locale=user.
This is something built into wordpress that I don’t have any understanding of.

Thanks for continuing to help on this.

Right, it’s trying to access the REST API, but it can’t because you have it split across multiple domains.

You should bring it together and get everything on the same domain so that you don’t have cross domain issues.

Moving to the same domain would cause me seo issues since my seo is built on blog.todaydata.com. I can’t move the blog to the todaydata.com host because that is a windows server and I don’t feel confident that wordpress works correctly on windows.

The thing is that everything was working great before this last update.

I guess I can use my work around to temporarily change the site address to the wordpress address when I need to add a blog post or edit.

Okay, let me try to explain this better.

The values for “site address” and “wordpress address” are not arbitrary. You cannot set them to what you want them to be. You instead have to set them to what they actually are.

In other words, those two fields are not filled in with your preferences. You fill them in with the correct values so that WordPress works properly. You are telling WordPress how to function, not telling it what you want it to do.

The WordPress Address URL tells WordPress where its core files are. The Site Address URL field tells it where the home URL is. These cannot be on separate servers. These cannot be wholly separate sites. That’s simply not how this thing works.

The address blog.todaydata.com is actually on the same server as todaydata.us. There is a dns A record on on the todaydata.com server pointing blog.todaydata.com to the same server as todaydata.us. So, blog.todaydata.com and todaydata.us are on the same server. All this worked correctly before. Yet, somehow wordpress thinks they are on different servers.

They cannot be on separate domains. Not anymore. Cross domain requests won’t work that way.

Yes, thanks. Seems this is the problem since the update.

I just realized the best and easiest fix for this. I just needed to change the wordpress url to https://blog.todaydata.com/blog instead of https://todaydata.us/blog. Now everything works as expected including saving edits and publishing.

So now:
wordpress url: blog.todaydata.com/blog
site url: blog.todaydata.com

Before it was
wordpress url: todaydata.us/blog
site url: blog.todaydata.com

Although both urls point to the same site, the first works, and the second does not. And previously, before the last update, the second did, in fact, work.