InfinityFree uses a security system on all free hosting accounts to ensure your website is accessed by real web browsers, not bots or automated scripts. While this protects your site from malicious traffic, it can affect certain types of access.
How the security system works
The system checks that visitors can execute JavaScript and accept cookies: features that all modern web browsers support. This verification happens automatically and most website visitors will never notice it.
You may occasionally see ?i=1 or similar parameters in your URL during this check, this is completely normal. Learn more about URL parameters.
What the security check looks like
A browser runs the check without you noticing. A tool or app that can’t run it gets a short HTML page instead of your page or file, usually with status 200. That page loads /aes.js, sets a cookie named __test and redirects to the same URL with ?i=1 added. Without JavaScript, it shows “This site requires Javascript to work”.
If an app, API client or tool reports something like “unexpected content type text/html”, “Unexpected token <” or “JSON parse error at line 1 column 1”, and the response contains aes.js, the request was stopped by the security system and never reached your code.
Can I exclude a URL or file?
No. The check covers every URL on your website, including static files like JSON, XML, web manifests and images. It can’t be turned off for one path, file type, user agent or IP address. Using your own domain name doesn’t change this either: the check is part of the hosting, not the domain.
What doesn’t work with this security system
Because the system requires JavaScript and cookies, these types of access won’t work:
Mobile and desktop apps
- Android or iOS mobile apps cannot connect to your website
- Desktop applications that try to fetch content from your site
- Progressive web apps (PWAs), manifests an service worker files, but there is a workaround
- Note: Mobile web browsers work perfectly fine
API and automated access
- REST APIs, WordPress XML-RPC, and similar services
- Command-line tools like cURL or wget
- Automated scripts and bots
- Webhooks from external services
- Devices like ESP32, Arduino and other IoT boards.
- Monitoring and cron services, like cron-job.org and UptimeRobot.
- Link previews: Facebook, WhatsApp, Discord and X (Open Graph tags won’t be read).
- AI tools and MCP clients.
- WordPress Jetpack.
Development and validation tools
- Website validators and SEO checking tools
- Domain verification systems used by some ad networks and webmaster tools
- Search engine testing tools, like Google Search Console’s live test (the Google crawler itself is exempt)
Cross-site requests
- AJAX requests from other domains (CORS)
- Embedding images or files from your site on other websites (hotlinking)
What still works normally
The security system only affects access to your website from external sources. These features work perfectly fine:
Outbound requests from your site
- Your website’s code can make API calls to external services
- Server-side scripts can fetch data from other websites
- External database connections work normally
Same-domain JavaScript requests
- AJAX calls within your own website work fine
- Single Page Applications (SPAs) can call APIs on the same domain
- JavaScript can fetch data from your own site’s endpoints
The key principle is that anything accessed through a real web browser, or outbound connections from your site, will work as expected.
Common error messages
When incompatible tools try to access your site, you might see:
- 403 Forbidden: The most common error for blocked requests
- “This site requires Javascript to work”: Shows when JavaScript is disabled or unavailable
- “No ‘Access-Control-Allow-Origin’ header”: Appears for blocked cross-domain requests
Benefits of this system
Protection from malicious bots: The system blocks automated attacks, login attempts, and spam bots that could compromise your site or consume server resources.
Prevents resource overuse: Malicious bots can quickly consume your account’s resource limits, potentially causing your website to be suspended. This security system helps ensure your resources are available for legitimate visitors.
Search engine compatibility: All major search engines (Google, Bing, etc.) support JavaScript and cookies, so your site will be indexed normally. Some validator tools may report issues, but actual search engine crawlers work fine.
Can I disable this system?
No, this security system is mandatory on all free hosting accounts and cannot be disabled.
If your website or application needs the blocked features, consider premium hosting. Premium hosting protects your site using less restrictive methods, allowing mobile apps, APIs, and automated tools to work normally.
