InfinityFree Security Challenge Blocking Elementor MCP API Requests

[Talha26]

Website URL

https://sultaninteriors.wuaze.com/

Error Message

MCP startup failed: Handshaking with MCP server failed. Codex CLI receives an unexpected content type: text/html instead of the expected MCP response.

The returned HTML contains a JavaScript challenge referencing /aes.js, sets a __test cookie, and redirects to the WordPress REST API endpoint with ?i=1.

Endpoint: https://sultaninteriors.wuaze.com/wp-json/elementor/mcp/

Codex CLI reports: “Unexpected content type: Some("text/html")” and “MCP startup incomplete (failed: sultan-interiors-elementor)”.

Other Information

Hello InfinityFree Support Team,

I am trying to connect Elementor MCP (Model Context Protocol) to OpenAI Codex CLI on my WordPress website hosted on InfinityFree.

Elementor MCP is enabled, and I have configured the server URL and WordPress Application Password authentication in Codex CLI. I have also regenerated the Application Password and updated the configuration, but the same error persists.

The endpoint appears to return an InfinityFree JavaScript security challenge instead of the expected API response. Since Codex CLI cannot execute browser-based JavaScript challenges, the MCP connection fails during initialization.

Could you please confirm whether InfinityFree’s security system blocks authenticated automated requests to WordPress REST API and MCP endpoints?

If this is caused by a hosting security restriction, is there a supported way to allow legitimate authenticated requests to this endpoint without triggering the JavaScript challenge?

Modern development tools increasingly rely on API integrations and MCP connections. I understand the importance of security, but developers also need reliable access to legitimate API endpoints. Please advise whether this limitation can be resolved on the free hosting plan.

Thank you for your assistance.

[InfinityFreeBot]

Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.

Yes, the security system is blocking your Codex CLI. It blocks authenticated requests too, and on the free plan there’s no supported way around it.

InfinityFree puts a browser check on all free hosting accounts. It needs the visitor to run JavaScript and accept cookies. That’s the /aes.js script, the __test cookie and the ?i=1 redirect you saw. Codex CLI can’t do either, so it gets the HTML challenge page instead of an MCP response. The check runs before the request reaches WordPress, so your Application Password never gets used. Having valid credentials doesn’t change anything.

This article lists REST APIs and similar automated access as affected:

Why isn't API access working on my website?

If you’re trying to use APIs on your InfinityFree website and they’re not working, this is due to our browser security system that’s required on all free hosting accounts. What’s happening? InfinityFree uses a security system that requires JavaScript and cookies to access websites. APIs and automated tools typically can’t execute JavaScript or store cookies, so they get blocked by the security system. When API clients try to connect, they usually receive a “403 Forbidden” error or a HTML respo…

The security system can’t be turned off on free hosting, and there’s no allowlist for specific endpoints. The guide to the system says so directly:

Browser Security System - Features and Limitations

InfinityFree uses a security system on all free hosting accounts to ensure your website is accessed by real web browsers, not bots or automated scripts. While this protects your site from malicious traffic, it can affect certain types of access. How the security system works The system checks that visitors can execute JavaScript and accept cookies: features that all modern web browsers support. This verification happens automatically and most website visitors will never notice it. You may occa…

The options the articles give are:

• Move to premium hosting, which doesn’t have this restriction, so APIs work normally.
• Host the API somewhere else.

Your Codex CLI is making inbound requests to your site, and those are what get blocked. Outbound requests from your site to other services still work.

[Talha26]

Thank you for the detailed explanation and for pointing me toward the relevant documentation.

I understand that InfinityFree’s browser security system blocks automated API requests, including authenticated requests, on free hosting accounts. This appears to explain why my Elementor MCP connection through OpenAI Codex CLI fails during initialization.

However, I would appreciate confirmation from a human support team member regarding whether there is any officially supported alternative for developers who need to connect legitimate tools such as Codex CLI to a WordPress REST API endpoint.

I fully understand the need to protect free hosting accounts against malicious traffic. At the same time, MCP integrations and AI-assisted development tools are becoming increasingly useful in modern WordPress workflows.

Could the support team please confirm whether this restriction is unavoidable on the free plan and whether any recommended workaround exists that does not require disabling security protections?

Thank you again for your assistance. I look forward to the support team’s clarification.

[dan3008]

@Talha26

any officially supported alternative for developers who need to connect legitimate tools such as Codex CLI to a WordPress REST API endpoint.

I believe the official built in wordpress ai tool works because it doesn’t need to create an inbound connection to your site

[Talha26]

Thank you for the clarification. I’ll look into the built-in WordPress AI tool. My goal is to use OpenAI Codex CLI with Elementor MCP to work directly with my WordPress website. I understand that this may not be possible on InfinityFree’s free hosting due to the inbound request restrictions.

[Admin]

You can skip the “may”. It’s not possible. The bot got it spot on.