Fixing the WordPress 'Update Failed: Download failed. Unauthorized' Error

Context

I was halfway through a routine maintenance sprint on a client’s production site when a simple update hit a wall. Everything looked normal until I clicked 'Update' on Elementor Pro and Advanced Custom Fields Pro. Instead of the usual progress bar, WordPress returned a blunt, red notification:

Update Failed: Download failed. Unauthorized

This error is notoriously vague. It doesn't specify if the problem lies with your server permissions, a firewall block, or your subscription status. In my experience, the issue usually stems from a breakdown in communication between your WordPress install and the vendor's update API.

Debug Process

Before touching any code, I started with the low-hanging fruit. I checked Tools > Site Health to confirm the server could actually reach external APIs. It could. From there, I pivoted to the plugin settings to look for three specific red flags:

License Validity: Has the subscription expired? Even a lapse of one day can trigger a 401 Unauthorized response from the vendor's server.
Domain Mismatches: Is the license still tied to a staging environment like dev.local or test.example.com while you're trying to update on the live production domain?
Stale Transients: WordPress caches update metadata in the database for about 12 hours. If the API rejected a request once, WordPress might be serving you that same cached 'Unauthorized' response.

Solutions

1. Re-sync the License (The 90% Fix)

Most premium developers use a token-based system to validate your domain. If that token expires or the handshake fails, the download will be blocked. For plugins like Elementor or WP Rocket, a quick 'reset' usually does the trick.

Head to the plugin’s license or account settings page.
Click Disconnect or Deactivate License.
Refresh your dashboard, then click Connect & Activate to fetch a fresh API token from the vendor.

2. Purge WordPress Update Transients

If you have already renewed your license but the error persists, WordPress is likely stuck on a cached error state. You need to force the site to talk to the vendor's server again. Using WP-CLI is the most efficient way to clear this data.

# Delete all cached transients
wp transient delete --all

# Force WordPress to check for fresh plugin data
wp plugin update --all --dry-run

If you aren't comfortable with the command line, navigate to Dashboard > Updates. Click the "Check Again" button. This manually triggers a refresh of the update list and clears the _site_transient_update_plugins entry in your database.

3. Resolve Domain Mismatches in the Vendor Portal

Vendors often hard-bind a license to a specific URL. If you migrated from a staging server to production, the vendor might still think the license belongs to the old address. Log in to your account at elementor.com or wp-rocket.me and check your 'Active Sites' list. If the old URL is listed, delete it and authorize the new production domain.

4. Perform a Manual Update (The Emergency Fallback)

When you're facing a critical security patch and the API won't cooperate, skip the automated installer. A manual update bypasses the 'Download failed' error because you are handling the file transfer yourself.

Download the latest .zip file directly from the vendor's member area.
Navigate to Plugins > Add New > Upload Plugin.
Upload the new version. WordPress will recognize the existing folder and ask if you want to replace it. Select "Replace current with uploaded."

5. Audit wp-config.php for Restrictions

Sometimes, high-security environments or previous developers might have locked down the site’s ability to modify files or make external calls. Check your wp-config.php file for these specific lines:

// If this is set to true, the UI update buttons will be disabled or fail
define( 'DISALLOW_FILE_MODS', false );

// Ensure the site isn't blocked from making external API calls
// define( 'WP_HTTP_BLOCK_EXTERNAL', true );

Verification

After re-syncing your license or clearing the transients, return to Dashboard > Updates. Select the plugin and try the update again. A successful fix will look like this:

Downloading update from https://api.vendor.com/...
Unpacking the update...
Installing the latest version...
Plugin updated successfully.

If the error remains, check your server’s PHP error logs at /var/log/apache2/error.log or wp-content/debug.log. Look for 403 Forbidden errors, which might indicate that your host’s firewall is blacklisting the vendor's IP range.

Lessons Learned

License first, server second: In the WordPress ecosystem, 'Unauthorized' almost always points to a license mismatch rather than folder permissions.
Clean your staging: Always deactivate licenses on staging sites before moving to production to avoid domain conflicts.
Transients are 'sticky': WordPress doesn't check for updates in real-time. When troubleshooting, always force a refresh via the Updates dashboard.