# 403 blocking Novamira OAuth registration on cuencaweb.xo.je **URL:** \ **Category:** Hosting Support\ **Created:** [October 28, 2026, 9:28pm UTC](https://forum.infinityfree.com/t/403-blocking-novamira-oauth-registration-on-cuencaweb-xo-je/121638 "2026-10-28T21:28:01Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![PedroCuenca](https://forum.infinityfree.com/letter_avatar/pedrocuenca/32/5_5575768a8748004e209b776fc1b2916d.png) [@PedroCuenca](https://forum.infinityfree.com/u/PedroCuenca)\ **Post date:** [October 28, 2026, 9:28pm UTC](https://forum.infinityfree.com/t/403-blocking-novamira-oauth-registration-on-cuencaweb-xo-je/121638/1 "2026-10-28T21:28:01Z")
### Website URL [https://cuencaweb.xo.je](https://cuencaweb.xo.je) ### Error Message Novamira Troubleshoot reports HTTP 403 for anonymous REST requests, /.well-known/oauth-protected-resource, and POST /wp-json/novamira/v1/oauth/register (expected 201). ### Other Information I’m trying to connect the Novamira WordPress MCP plugin to ChatGPT at [https://cuencaweb.xo.je/wp-json/mcp/novamira-oauth](https://cuencaweb.xo.je/wp-json/mcp/novamira-oauth). No security plugin is active; W3 Total Cache is inactive; .htaccess has the standard WordPress rewrite rules, including Authorization header forwarding. Could you check whether a hosting firewall or other server-side security rule is returning these 403 responses, and whether REST/OAuth discovery and registration requests can be allowed for this domain? The affected paths are /wp-json/, /.well-known/oauth-protected-resource, /.well-known/oauth-authorization-server, and POST /wp-json/novamira/v1/oauth/register. Thanks. ---
**Author:** ![system](https://infinityfree-forum-uploads.s3.dualstack.eu-central-1.amazonaws.com/original/3X/b/0/b024fd3fa88bae093c9576e55c2c94e33f890206.svg) [@system](https://forum.infinityfree.com/u/system)\ **Post date:** [October 28, 2026, 9:28pm UTC](https://forum.infinityfree.com/t/403-blocking-novamira-oauth-registration-on-cuencaweb-xo-je/121638/2 "2026-10-28T21:28:02Z")
Welcome to the InfinityFree community forum! Good to have you here. - Most people answering here are volunteers. They’re often the fastest source of help. Admin (the only staff member) checks in about once a day for issues on our end. - Volunteers can’t see your account or website. Share what you actually see, like error messages and what happens when you try something. That’s more useful than your theory of what’s wrong. - AI tools often get InfinityFree wrong. If a volunteer’s advice differs from what an AI told you, please try the volunteer’s suggestion first. - Solving an issue is a joint effort. Try the suggestions you get and report back what happened. ---
**Author:** ![Lemni](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/lemni/32/68303_2.png) [@Lemni](https://forum.infinityfree.com/u/Lemni)\ **Post date:** [October 28, 2026, 9:28pm UTC](https://forum.infinityfree.com/t/403-blocking-novamira-oauth-registration-on-cuencaweb-xo-je/121638/3 "2026-10-28T21:28:16Z")
_Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look._ This isn’t a firewall rule on your domain. It’s the browser security system that every free InfinityFree account has, and it blocks anonymous API requests. The article below lists “AI tools and MCP clients” and REST APIs among the things that can’t get through. ChatGPT connecting to Novamira’s OAuth endpoints is that kind of request. The system only lets through clients that can run JavaScript and keep a cookie. Anything else, like the Novamira troubleshooter or ChatGPT’s connector, is stopped before WordPress sees the request. That fits the 403s you’re getting on `/wp-json/`, `/.well-known/…` and the `POST` to `/oauth/register`. The article also says the check can’t be turned off for a specific path, user agent or IP address. So there’s no way to allow those endpoints on this domain, and nothing in `.htaccess` or WordPress will change it. Here’s the article on the security system and what it blocks: > [@Browser Security System - Features and Limitations](https://forum.infinityfree.com/t/browser-security-system-features-and-limitations/49353): > > InfinityFree uses a security system on all free hosting accounts to ensure your website is accessed by real web browsers, not bots or automated scripts. While this protects your site from malicious traffic, it can affect certain types of access. How the security system works The system checks that visitors can execute JavaScript and accept cookies: features that all modern web browsers support. This verification happens automatically and most website visitors will never notice it. You may occa… And this one covers API access in particular, including the options that are left: > [@Why isn't API access working on my website?](https://forum.infinityfree.com/t/why-isnt-api-access-working-on-my-website/115198): > > If you’re trying to use APIs on your InfinityFree website and they’re not working, this is due to our browser security system that’s required on all free hosting accounts. What’s happening? InfinityFree uses a security system that requires JavaScript and cookies to access websites. APIs and automated tools typically can’t execute JavaScript or store cookies, so they get blocked by the security system. When API clients try to connect, they usually receive a “403 Forbidden” error or a HTML respo… Those options are [premium hosting](https://www.infinityfree.com/premium/), which doesn’t have this restriction, or hosting the API side somewhere else. ---
**Author:** ![dan3008](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/dan3008/32/53336_2.png) [@dan3008](https://forum.infinityfree.com/u/dan3008)\ **Post date:** [October 28, 2026, 9:33pm UTC](https://forum.infinityfree.com/t/403-blocking-novamira-oauth-registration-on-cuencaweb-xo-je/121638/4 "2026-10-28T21:33:23Z")
the security system blocks none browser connections, including ChatGPT. This is a core part of the free hosting, and cannot be dissabled