⚡ Quick Fix (TL;DR)

The Culprit: Site Health's REST API check (cURL error 28: Operation timed out) kept flapping between clear and broken over several hours — even after adding a Sucuri WAF allowlist rule for /wp-json/. The rule saved without error and looked correct, but the timeout kept returning on its own unpredictable schedule.

The Fix: The rule itself wasn't wrong — it just hadn't been picked up cleanly by the firewall's rule engine. Toggling Sucuri's firewall off, then back on, forced a full rule reload, and the timeout stopped recurring afterward. A saved WAF/CDN rule isn't guaranteed to be "live" the instant it's saved; if a fix looks correct on paper but the symptom keeps intermittently returning, cycling the security layer off and on is worth trying before concluding the rule itself is wrong.