diff --git a/assets/js/follow.js b/assets/js/follow.js
index e5b9788f..eb70f547 100644
--- a/assets/js/follow.js
+++ b/assets/js/follow.js
@@ -8,7 +8,11 @@
 (function () {
   'use strict';
 
-  var API_ROOT = (window.aksrtData && window.aksrtData.apiUrl) || '/wp-json/aksrt/v1';
+  var API_ROOT = (function () {
+    var d = window.aksrtData || {};
+    var raw = d.apiUrl || d.restUrl || d.rest_url || '/index.php?rest_route=/aksrt/v1';
+    return String(raw).replace(/\/$/, '');
+  })();
   var NONCE    = (window.aksrtData && window.aksrtData.restNonce) || '';
 
   function initFollowButtons() {
diff --git a/assets/js/modal-auth.js b/assets/js/modal-auth.js
index 46f67739..3debd2bc 100644
--- a/assets/js/modal-auth.js
+++ b/assets/js/modal-auth.js
@@ -7,7 +7,30 @@
 (function () {
     'use strict';
 
-    var API_ROOT = (window.aksrtData && window.aksrtData.apiUrl) || '/wp-json/aksrt/v1';
+    /**
+     * Resolve REST root for aksrt/v1.
+     * Prefer aksrtData.restUrl (works with plain permalinks: index.php?rest_route=/aksrt/v1).
+     * Do not hardcode /wp-json when rewrite rules are off — that 404s on Apache.
+     */
+    function resolveApiRoot() {
+        var d = window.aksrtData || {};
+        var raw = d.apiUrl || d.restUrl || d.rest_url || '';
+        if (!raw) {
+            raw = '/index.php?rest_route=/aksrt/v1';
+        }
+        raw = String(raw).trim();
+        // restUrl may be site root rest_url() without namespace in some localizes — ensure aksrt/v1.
+        if (/rest_route=\/?$/.test(raw) || /\/wp-json\/?$/.test(raw)) {
+            if (raw.indexOf('rest_route=') !== -1) {
+                raw = raw.replace(/rest_route=\/?$/, 'rest_route=/aksrt/v1');
+            } else {
+                raw = raw.replace(/\/?$/, '/') + 'aksrt/v1';
+            }
+        }
+        return raw.replace(/\/$/, '');
+    }
+
+    var API_ROOT = resolveApiRoot();
     var NONCE = (window.aksrtData && window.aksrtData.restNonce) || '';
 
     var modal = null;
@@ -310,17 +333,39 @@
             headers['X-WP-Nonce'] = NONCE;
         }
 
-        return fetch(API_ROOT + path, {
+        var url = joinRestPath(API_ROOT, path);
+
+        return fetch(url, {
             method: 'POST',
             headers: headers,
+            credentials: 'same-origin',
             body: JSON.stringify(payload),
         }).then(function (response) {
             return response.json().then(function (data) {
                 return { ok: response.ok, data: data };
+            }).catch(function () {
+                return { ok: false, data: { message: '响应解析失败' } };
             });
         });
     }
 
+    /**
+     * Join REST root + path for both pretty (/wp-json/aksrt/v1/x)
+     * and plain (?rest_route=/aksrt/v1/x) permalinks.
+     */
+    function joinRestPath(root, path) {
+        path = String(path || '');
+        if (path.charAt(0) !== '/') {
+            path = '/' + path;
+        }
+        root = String(root || '').replace(/\/$/, '');
+        if (root.indexOf('rest_route=') !== -1) {
+            // e.g. https://host/index.php?rest_route=/aksrt/v1 + /auth/modal-login
+            return root + path;
+        }
+        return root + path;
+    }
+
     function prefillLogin(value) {
         var loginInput = document.getElementById('modal-login-user');
         if (loginInput && value) {
diff --git a/assets/js/report.js b/assets/js/report.js
index e98a55df..e6275ffa 100644
--- a/assets/js/report.js
+++ b/assets/js/report.js
@@ -9,7 +9,11 @@
 (function () {
   'use strict';
 
-  var API_ROOT = (window.aksrtData && window.aksrtData.apiUrl) || '/wp-json/aksrt/v1';
+  var API_ROOT = (function () {
+    var d = window.aksrtData || {};
+    var raw = d.apiUrl || d.restUrl || d.rest_url || '/index.php?rest_route=/aksrt/v1';
+    return String(raw).replace(/\/$/, '');
+  })();
   var NONCE    = (window.aksrtData && window.aksrtData.restNonce) || '';
 
   function getReportCategories() {