# Every POST request returns 403 Forbidden (openresty), GET works — dieta.gt.tc **URL:** \ **Category:** Hosting Support\ **Created:** [October 22, 2026, 7:23am UTC](https://forum.infinityfree.com/t/every-post-request-returns-403-forbidden-openresty-get-works-dieta-gt-tc/121502 "2026-10-22T07:23:14Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![alvaaroojg](https://forum.infinityfree.com/letter_avatar/alvaaroojg/32/5_5575768a8748004e209b776fc1b2916d.png) [@alvaaroojg](https://forum.infinityfree.com/u/alvaaroojg)\ **Post date:** [October 22, 2026, 7:23am UTC](https://forum.infinityfree.com/t/every-post-request-returns-403-forbidden-openresty-get-works-dieta-gt-tc/121502/1 "2026-10-22T07:23:14Z")
### Website URL [https://dieta.gt.tc](https://dieta.gt.tc) ### Error Message 403 Forbidden – openresty (on every POST request; GET requests work normally) ### Other Information Since 21 Oct 2026 (~12:40 CEST) every POST request to my site returns “403 Forbidden – openresty”. GET requests work fine. It happens from different networks (home Wi-Fi and another location), so it doesn’t seem to be my IP. To prove it isn’t my code, I created a test file: [https://dieta.gt.tc/prueba\_post.php](https://dieta.gt.tc/prueba_post.php) It always prints {“llega”:true}. - GET to it → 200 with that JSON. - POST to it with a tiny form (2 fields) → 403 openresty page, so the request never reaches PHP. It also happens with my .htaccess removed. Everything worked fine until 20 Oct. Account username: if0\_41999509 Could you please check whether my account or domain was flagged and lift the block? Thank you! ---
**Author:** ![system](https://infinityfree-forum-uploads.s3.dualstack.eu-central-1.amazonaws.com/original/3X/b/0/b024fd3fa88bae093c9576e55c2c94e33f890206.svg) [@system](https://forum.infinityfree.com/u/system)\ **Post date:** [October 22, 2026, 7:23am UTC](https://forum.infinityfree.com/t/every-post-request-returns-403-forbidden-openresty-get-works-dieta-gt-tc/121502/2 "2026-10-22T07:23:15Z")
Welcome to the InfinityFree community forum! Good to have you here. - Most people answering here are volunteers. They’re often the fastest source of help. Admin (the only staff member) checks in about once a day for issues on our end. - Volunteers can’t see your account or website. Share what you actually see, like error messages and what happens when you try something. That’s more useful than your theory of what’s wrong. - AI tools often get InfinityFree wrong. If a volunteer’s advice differs from what an AI told you, please try the volunteer’s suggestion first. - Solving an issue is a joint effort. Try the suggestions you get and report back what happened. ---
**Author:** ![Lemni](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/lemni/32/68303_2.png) [@Lemni](https://forum.infinityfree.com/u/Lemni)\ **Post date:** [October 22, 2026, 7:23am UTC](https://forum.infinityfree.com/t/every-post-request-returns-403-forbidden-openresty-get-works-dieta-gt-tc/121502/3 "2026-10-22T07:23:27Z")
_Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look._ Your account hasn’t been flagged. This matches an open incident on our status page: POST requests using `multipart/form-data` are currently being blocked before they reach PHP, on all accounts. The incident says the block is there because of two severe PHP security issues. The fixed PHP packages haven’t been released yet. Until they are published and rolled out on all hosting servers, [iFastNet](https://www.infinityfree.com/go/ifastnet) is blocking certain requests from reaching PHP, including all `multipart/form-data` POSTs. That’s why your test file never runs on a POST. The incident also says POSTs using form-urlencoded data are not affected. Forms that send `application/x-www-form-urlencoded` should still work. If your test form or your site’s forms use `multipart/form-data` (the default for file uploads, or when `enctype="multipart/form-data"` is set), that would explain the 403s. Sending the same two fields as urlencoded would show whether that’s the case. Here is the incident, with its updates: > **[Websites are returning 403 errors from OpenResty on POST requests |...](https://status.infinityfree.com/issues/2026-10-21-403-errors/)** > > Identified - We have received confirmation from iFastNet about this issue. > Earlier today, a critical update to PHP was released that fixes two severe security issues. These issues could cause serious harm on our hosting if exploited. > Our hosting runs... ---
**Author:** ![dan3008](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/dan3008/32/53336_2.png) [@dan3008](https://forum.infinityfree.com/u/dan3008)\ **Post date:** [October 22, 2026, 7:25am UTC](https://forum.infinityfree.com/t/every-post-request-returns-403-forbidden-openresty-get-works-dieta-gt-tc/121502/4 "2026-10-22T07:25:58Z")
Welcome to the forum I’m going to assume you’ve read the banner at the top of the page that explains this? The link the bot posted: > **[Websites are returning 403 errors from OpenResty on POST requests |...](https://status.infinityfree.com/issues/2026-10-21-403-errors/)** > > Identified - We have received confirmation from iFastNet about this issue. > Earlier today, a critical update to PHP was released that fixes two severe security issues. These issues could cause serious harm on our hosting if exploited. > Our hosting runs... will give you more details This has been done by [IFastNet](https://www.infinityfree.com/go/ifastnet) (who provide the infrastructure that InfinityFree is built on) to mitigate some major security vulnerabilities in the current PHP version. Once they’ve been able to update the PHP version, this restriction should be lifted. ---
**Author:** ![cams\_forum](https://forum.infinityfree.com/letter_avatar/cams_forum/32/5_5575768a8748004e209b776fc1b2916d.png) [@cams\_forum](https://forum.infinityfree.com/u/cams_forum)\ **Post date:** [October 22, 2026, 9:09am UTC](https://forum.infinityfree.com/t/every-post-request-returns-403-forbidden-openresty-get-works-dieta-gt-tc/121502/5 "2026-10-22T09:09:13Z")
All we have to do is to wait for them to fix it.