Every POST request returns 403 Forbidden (openresty), GET works — dieta.gt.tc

Hosting Support
1

Website URL

https://dieta.gt.tc

Error Message

403 Forbidden – openresty (on every POST request; GET requests work normally)

Other Information

Since 21 Oct 2026 (~12:40 CEST) every POST request to my site returns “403 Forbidden – openresty”. GET requests work fine. It happens from different networks (home Wi-Fi and another location), so it doesn’t seem to be my IP.

To prove it isn’t my code, I created a test file: https://dieta.gt.tc/prueba_post.php
It always prints {“llega”:true}.

  • GET to it → 200 with that JSON.
  • POST to it with a tiny form (2 fields) → 403 openresty page, so the request never reaches PHP.

It also happens with my .htaccess removed. Everything worked fine until 20 Oct.

Account username: if0_41999509

Could you please check whether my account or domain was flagged and lift the block? Thank you!

2

Welcome to the InfinityFree community forum! Good to have you here.

  • Most people answering here are volunteers. They’re often the fastest source of help. Admin (the only staff member) checks in about once a day for issues on our end.
  • Volunteers can’t see your account or website. Share what you actually see, like error messages and what happens when you try something. That’s more useful than your theory of what’s wrong.
  • AI tools often get InfinityFree wrong. If a volunteer’s advice differs from what an AI told you, please try the volunteer’s suggestion first.
  • Solving an issue is a joint effort. Try the suggestions you get and report back what happened.
3

Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.

Your account hasn’t been flagged. This matches an open incident on our status page: POST requests using multipart/form-data are currently being blocked before they reach PHP, on all accounts.

The incident says the block is there because of two severe PHP security issues. The fixed PHP packages haven’t been released yet. Until they are published and rolled out on all hosting servers, iFastNet is blocking certain requests from reaching PHP, including all multipart/form-data POSTs. That’s why your test file never runs on a POST.

The incident also says POSTs using form-urlencoded data are not affected. Forms that send application/x-www-form-urlencoded should still work. If your test form or your site’s forms use multipart/form-data (the default for file uploads, or when enctype="multipart/form-data" is set), that would explain the 403s. Sending the same two fields as urlencoded would show whether that’s the case.

Here is the incident, with its updates:

4

Welcome to the forum

I’m going to assume you’ve read the banner at the top of the page that explains this?

The link the bot posted:

will give you more details

This has been done by IFastNet (who provide the infrastructure that InfinityFree is built on) to mitigate some major security vulnerabilities in the current PHP version. Once they’ve been able to update the PHP version, this restriction should be lifted.