Missing Categories/Tags selector in Gutenberg 2.9.2

[marybaum]

Describe the bug
Category/tag selector missing from interface on post of image blocks.

To Reproduce
Steps to reproduce the behavior:

1. Log in to http://marybaum.com as admin.
2. Create or edit a post with Gutenberg.
3. Look to the right-hand sidebar for categories/tags panel.
4. Discover it's missing.
5. (Workaround) Finish the post, head for All Posts and apply category/tag/etc from Quick Edit.

Expected behavior
Ability to check existing categories and tags from a dialog panel in the block eidtor, and add new if I want.

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• High Sierra Mac OS 10.13.4
• Chrome 66

Smartphone (please complete the following information):

• n/a

Additional context

• Please add the version of Gutenberg you are using in the description.
• 2.9.2

[danielbachhuber]

Hi @marybaum,

Thanks for the report. Can you share any debugging you've done (deactivating plugins and otherwise)?

Previously #5879 (comment)

[adamsilverstein]

Hi @marybaum -

I looked at your site's rest api endpoints, and it appears the category and tag endpoints are being blocked by the ithemes security plugin. the endpoints need to be accessible for Gutenberg to use them so this may be the source of your problem. Does the plugin have a setting where you can enable those endpoints?

http://www.marybaum.com/wp-json/wp/v2/categories (same for tags

shows an error:
You do not have sufficient permission to access this endpoint. Access to REST API requests is restricted by iThemes Security settings.

[SymbolicallyMe]

Hi @marybaum,

@adamsilverstein is correct, iThemes Security 6.0.0+ (free version) and iThemes Security Pro 3.4.0+ has the ability to block most WP REST API endpoints. The option that controls this functionality is located under WordPress Tweaks > REST API in your iThemes Security settings.

The two options you can choose from are:

• Restricted Access - Restrict access to most REST API data. This means that most requests will require a logged in user or a user with specific privileges, blocking public requests for potentially-private data. We recommend selecting this option.
• Default Access - Access to REST API data is left as default. Information including published posts, user details, and media library entries is available for public access.

Reference: https://ithemes.com/security/wordpress-rest-api-restrict-access/

[marybaum]

Ah. Let me play with the settings.

This particular install is a replacement for one that got pwned a couple of weeks ago, so in committing the folly of putting it back on the same domain and the same hosting account, I have turned up all the security settings to eleventy.

[marybaum]

That fixed it! Thank you!

[marybaum]

Guess I'll close this now, and be educated. 😜