I’m hosting a site on mis-nsrmutt.great-site.net (account ID: if0_42384516). Since earlier today, every request to any file under my /api/ subdirectory returns the InfinityFree branded “403 Forbidden” error page, while the rest of the site (e.g. the homepage) loads completely normally. This has taken down my entire application, since all backend functionality lives under /api/.
What I think triggered it: I briefly uploaded a JSON file into a subfolder (api/key/) containing a Google Cloud service-account credential (an RSA private key), while testing a Google Calendar integration. Shortly after that upload, /api/ started returning 403 for everything — even completely unrelated files in that folder. I’ve since deleted that file (and reverted the code around it), but the block hasn’t lifted on its own, which makes me think it’s a sticky/account-level flag rather than something tied to that one file still being present.
What I’m hoping for: Could an admin/mod check whether /api/ on my account has been automatically flagged (e.g. by a secret-scanner or WAF) and help me get it unblocked? I couldn’t find a direct support/ticket channel, which is why I’m posting here. Happy to provide exact filenames/timestamps if that helps.
apart from Admin, none of us here can check anything back end.
Might be worth trying renaming the directory, and files inside, to make sure you’re not accidentally using a blocked key work, like “chat” in there that could be causing the 403.
However its worth noting that you cant host API’s here. you can have code that reaches out to the google calendar API, but not the other way around.
this article can help provide more information on that:
Thank you for the explanation, but I don’t think this is the standard bot-protection behavior. My /api/ endpoints have worked via same-domain AJAX calls (real browser, JS enabled, cookies accepted) for months without issue — the entire site is a single-page app that calls /api/ constantly. The 403 block started immediately after I uploaded (and have since deleted) a JSON credential file, and even now, testing from within the site itself using a real browser (not curl/scripts) still returns 403 for every /api/ request. Could you check if there’s an additional flag on my account specifically, beyond the standard JS/cookie check?
You have setup a .htaccess file that starts with a comment saying it’s intended to block access to the service account key. But the actual code blocks access to everything for everyone in the entire api folder, not just the service account file.
Your hosting account is working as intended, and is responding as you’ve configured it to.
You can either move the service account file and the .htaccess file to a subfolder, so the main API folder is unblocked, or extend the .htaccess rules so it only blocks access to specific files or file patterns instead of the entire folder.