# 403 forbidden error when trying to hit the rest api endpoint of a plugin installed on my site

**URL:** <https://forum.infinityfree.com/t/403-forbidden-error-when-trying-to-hit-the-rest-api-endpoint-of-a-plugin-installed-on-my-site/93693>\
**Category:** Hosting Support\
**Created:** [May 17, 2024, 5:55am UTC](https://forum.infinityfree.com/t/403-forbidden-error-when-trying-to-hit-the-rest-api-endpoint-of-a-plugin-installed-on-my-site/93693 "2024-05-17T05:55:05Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![maheswar](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/maheswar/32/47768_2.png) [@maheswar](https://forum.infinityfree.com/u/maheswar)\
**Post date:** [May 17, 2024, 5:55am UTC](https://forum.infinityfree.com/t/403-forbidden-error-when-trying-to-hit-the-rest-api-endpoint-of-a-plugin-installed-on-my-site/93693/1 "2024-05-17T05:55:05Z")

</div>

### Website URL

[(please specify the URL of the site on which you are experiencing the problem)](http://connection-testing.kesug.com/)

### Error Message

I created a simple plugin inside which I registered an api endpoint, upon successful returns site url.  
But I am getting 403 forbidden error as a response when I call this api endpoint from my other site.  
Below is the part of a error message:-

```auto
(
    [headers] => WpOrg\Requests\Utility\CaseInsensitiveDictionary Object
        (
            [data:protected] => Array
                (
                    [server] => nginx
                    [date] => Wed, 15 May 2024 16:54:20 GMT
                    [content-type] => text/html
                    [content-length] => 146
                )

        )

    [body] => <html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx</center>
</body>
</html>

    [response] => Array
        (
            [code] => 403
            [message] => Forbidden
        )

    [cookies] => Array
        (
        )

```

### Other Information

Below is the piece of code I written to register endpoint:-

```auto
add_action( 'rest_api_init', 'register_routes' );
function register_routes() {
	register_rest_route(
		'mahi/v1',
		'/settings',
		array(
			array(
				'methods' => 'GET',
				'callback' => 'get_items',
				'permission_callback' => 'create_items_permissions_check',
			),
		)
	);
}

function create_items_permissions_check() {
	return true;
}
function get_items() {
	return rest_ensure_response( get_site_url() );
}

```

---

<div class="post-metadata">

**Author:** ![KangJL](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/kangjl/32/12130_2.png) [@KangJL](https://forum.infinityfree.com/u/KangJL)\
**Post date:** [May 17, 2024, 6:57am UTC](https://forum.infinityfree.com/t/403-forbidden-error-when-trying-to-hit-the-rest-api-endpoint-of-a-plugin-installed-on-my-site/93693/2 "2024-05-17T06:57:26Z")

</div>

> [@maheswar](#):
>
> 403 forbidden error

Please read

> [@Redirected to InfinityFree 403 Forbidden page](https://forum.infinityfree.com/t/redirected-to-infinityfree-403-forbidden-page/58664/):
>
> Getting a 403 error means the server is refusing to show your webpage. Here are the most common causes and how to fix them: 1. Website Files Are in the Wrong Location The Issue: Your domain might be pointing to an empty or non-existent folder. How to Check: Log into your [InfinityFree client area](https://dash.infinityfree.com) Go to Accounts → [Select your account] → Domains → [Find your domain] → Manage Find the Directory Status card, and look at the Directory displayed there Understanding the folder structure: Your fi…

Take note

> [@Browser Security System - Features and Limitations](https://forum.infinityfree.com/t/ensuring-only-web-browsers-can-access-your-website/49353/):
>
> InfinityFree uses a security system on all free hosting accounts to ensure your website is accessed by real web browsers, not bots or automated scripts. While this protects your site from malicious traffic, it can affect certain types of access. How the security system works The system checks that visitors can execute JavaScript and accept cookies: features that all modern web browsers support. This verification happens automatically and most website visitors will never notice it. You may occa…

---

<div class="post-metadata">

**Author:** ![maheswar](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/maheswar/32/47768_2.png) [@maheswar](https://forum.infinityfree.com/u/maheswar)\
**Post date:** [May 17, 2024, 8:47am UTC](https://forum.infinityfree.com/t/403-forbidden-error-when-trying-to-hit-the-rest-api-endpoint-of-a-plugin-installed-on-my-site/93693/3 "2024-05-17T08:47:15Z")

</div>

Can anyone elaborate what does this mean, “InfinityFree is not intended to be used for file sharing, API hosting, database hosting or background tasks/tools.”

And is aes.js responsible on why I am getting 403 forbidden error when I hit this endpoint ?

---

<div class="post-metadata">

**Author:** ![Meishin](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/meishin/32/59902_2.png) [@Meishin](https://forum.infinityfree.com/u/Meishin)\
**Post date:** [May 17, 2024, 9:46am UTC](https://forum.infinityfree.com/t/403-forbidden-error-when-trying-to-hit-the-rest-api-endpoint-of-a-plugin-installed-on-my-site/93693/4 "2024-05-17T09:46:17Z")

</div>

> [@maheswar](#):
>
> Can anyone elaborate what does this mean, “InfinityFree is not intended to be used for file sharing, API hosting, database hosting or background tasks/tools.”

It means what it means. InfinityFree’s service shouldn’t be used on these subjects, only on website hosting.

> [@maheswar](#):
>
> And is aes.js responsible on why I am getting 403 forbidden error when I hit this endpoint ?

It should be responsible. As you can see, the response indicated that the server was using nginx, which is a sign of hitting the aes.js without moving on.

---

<div class="post-metadata">

**Author:** ![maheswar](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/maheswar/32/47768_2.png) [@maheswar](https://forum.infinityfree.com/u/maheswar)\
**Post date:** [May 17, 2024, 10:13am UTC](https://forum.infinityfree.com/t/403-forbidden-error-when-trying-to-hit-the-rest-api-endpoint-of-a-plugin-installed-on-my-site/93693/5 "2024-05-17T10:13:26Z")

</div>

> [@Meishin](#):
>
> It means what it means. InfinityFree’s service shouldn’t be used on these subjects, only on website hosting.

Does it mean any plugin in which an api endpoint is registered won’t work on InfinityFree hosting sites if that api get hits from other sites ?

> [@Meishin](#):
>
> It should be responsible. As you can see, the response indicated that the server was using nginx, which is a sign of hitting the aes.js without moving on.

How to handle this in code to make the api response successful(i.e, 200). Any help will be appreciated, Thank you

---

<div class="post-metadata">

**Author:** ![Meishin](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/meishin/32/59902_2.png) [@Meishin](https://forum.infinityfree.com/u/Meishin)\
**Post date:** [May 17, 2024, 10:15am UTC](https://forum.infinityfree.com/t/403-forbidden-error-when-trying-to-hit-the-rest-api-endpoint-of-a-plugin-installed-on-my-site/93693/6 "2024-05-17T10:15:49Z")

</div>

> [@maheswar](#):
>
> if that api get hits from other sites ?

Yes. They can indeed work if the AJAX calls come from within the site.

> [@maheswar](#):
>
> How to handle this in code to make the api response successful(i.e, 200).

You can’t handle this to make it success. A limit is a limit. No matter how hard you try to handle this, it won’t work, as the code you are trying to set up won’t even be fired because the request never gets there.

---

<div class="post-metadata">

**Author:** ![maheswar](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/maheswar/32/47768_2.png) [@maheswar](https://forum.infinityfree.com/u/maheswar)\
**Post date:** [May 17, 2024, 11:51am UTC](https://forum.infinityfree.com/t/403-forbidden-error-when-trying-to-hit-the-rest-api-endpoint-of-a-plugin-installed-on-my-site/93693/7 "2024-05-17T11:51:14Z")

</div>

Thank you for the information.

Why is it not allowing the request ? Is it possible that the protection system is flagging this as malicious activity?

Will I get the 403 forbidden error due to this aes.js file on paid site as well ?

Does anyone have any insights regarding this?

---

<div class="post-metadata">

**Author:** ![Meishin](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/meishin/32/59902_2.png) [@Meishin](https://forum.infinityfree.com/u/Meishin)\
**Post date:** [May 17, 2024, 12:29pm UTC](https://forum.infinityfree.com/t/403-forbidden-error-when-trying-to-hit-the-rest-api-endpoint-of-a-plugin-installed-on-my-site/93693/8 "2024-05-17T12:29:11Z")

</div>

> [@maheswar](#):
>
> Is it possible that the protection system is flagging this as malicious activity?

The security system indeed blocks automated requests. But that system is no where near intelligent — so it cannot “flag a request as malicious”.  
It depends on technologies that are decades old and simply checks whether the incoming request can execute JavaScript and allow cookies, which mainly includes browsers and search engines.

* * *

> [@maheswar](#):
>
> Will I get the 403 forbidden error due to this aes.js file on paid site as well ?

Premium hosting doesn’t have this system, so no.

---

<div class="post-metadata">

**Author:** ![Admin](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/admin/32/36437_2.png) [@Admin](https://forum.infinityfree.com/u/Admin)\
**Post date:** [May 17, 2024, 3:39pm UTC](https://forum.infinityfree.com/t/403-forbidden-error-when-trying-to-hit-the-rest-api-endpoint-of-a-plugin-installed-on-my-site/93693/9 "2024-05-17T15:39:09Z")

</div>

> [@maheswar](#):
>
> And is aes.js responsible on why I am getting 403 forbidden error when I hit this endpoint ?

Short answer: yes.

Longer answer: in addition to the aes.js system, there are additional rules that visitors are checked against before they reach the aes.js system to begin with. Those tend to cause 403 Forbidden errors. If not, you’d likely get a 200 OK response, but with the HTML code for the challenge page instead of the actual content you’re trying to reach. So while it’s not technically aes.js that’s causing this, both are part of our suite of security measures for your website.

---

<div class="post-metadata">

**Author:** ![maheswar](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/maheswar/32/47768_2.png) [@maheswar](https://forum.infinityfree.com/u/maheswar)\
**Post date:** [May 20, 2024, 6:57am UTC](https://forum.infinityfree.com/t/403-forbidden-error-when-trying-to-hit-the-rest-api-endpoint-of-a-plugin-installed-on-my-site/93693/10 "2024-05-20T06:57:33Z")

</div>

Thank you Admin for the information.

@Admin I have a plugin and an api endpoint is registered in the plugin. I am getting this 403 forbidden error when I call this endpoint from another site. Is there a way for me on how to check with code that your security system doesn’t allow/process this request so that I can fallback to another approach ? Any help will be appreciated. Thank you.

@Admin Is the same security system/check there on your premium hosting sites ?

---

<div class="post-metadata">

**Author:** ![Admin](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/admin/32/36437_2.png) [@Admin](https://forum.infinityfree.com/u/Admin)\
**Post date:** [May 20, 2024, 8:35am UTC](https://forum.infinityfree.com/t/403-forbidden-error-when-trying-to-hit-the-rest-api-endpoint-of-a-plugin-installed-on-my-site/93693/11 "2024-05-20T08:35:18Z")

</div>

> [@maheswar](#):
>
> Is there a way for me on how to check with code that your security system doesn’t allow/process this request so that I can fallback to another approach ?

You already noted you get a 403 Forbidden error when you try the API request. You could just check for that response code and use the fallback if you get a 403.

Although I don’t fully understand why you would want to check for this with code if you already know the endpoint doesn’t work.

> [@maheswar](#):
>
> Is the same security system/check there on your premium hosting sites ?

No, this system is only present on free hosting, not premium hosting.

---

<div class="post-metadata">

**Author:** ![system](https://infinityfree-forum-uploads.s3.dualstack.eu-central-1.amazonaws.com/original/3X/b/0/b024fd3fa88bae093c9576e55c2c94e33f890206.svg) [@system](https://forum.infinityfree.com/u/system)\
**Post date:** [May 27, 2024, 8:35am UTC](https://forum.infinityfree.com/t/403-forbidden-error-when-trying-to-hit-the-rest-api-endpoint-of-a-plugin-installed-on-my-site/93693/12 "2024-05-27T08:35:26Z")

</div>

Closed on May 27, 2024, 8:35am UTC

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.