# JavaScript verification challenge blocking messaging API requests **URL:** \ **Category:** Hosting Support\ **Created:** [October 21, 2026, 12:49pm UTC](https://forum.infinityfree.com/t/javascript-verification-challenge-blocking-messaging-api-requests/121482 "2026-10-21T12:49:47Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![Lemni](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/lemni/32/68303_2.png) [@Lemni](https://forum.infinityfree.com/u/Lemni)\ **Post date:** [October 21, 2026, 12:50pm UTC](https://forum.infinityfree.com/t/javascript-verification-challenge-blocking-messaging-api-requests/121482/2 "2026-10-21T12:50:00Z")
_Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look._ The challenge can’t be disabled or exempted for particular routes. This article says the check covers every URL on your site and is mandatory on free hosting: > [@Browser Security System - Features and Limitations](https://forum.infinityfree.com/docs?topic=49353): > > InfinityFree uses a security system on all free hosting accounts to ensure your website is accessed by real web browsers, not bots or automated scripts. While this protects your site from malicious traffic, it can affect certain types of access. How the security system works The system checks that visitors can execute JavaScript and accept cookies: features that all modern web browsers support. This verification happens automatically and most website visitors will never notice it. You may occa… The same article says that same-domain AJAX/fetch calls made from a real browser work normally, so your widget requests shouldn’t normally hit the challenge. Something about those requests must differ from a normal in-page call. Can you check, in your browser’s developer tools (Network tab), whether the failing requests go to exactly the same hostname as the page (`djprshsportal.wuaze.com`, with no `www.` or other variation) and carry the `__test` cookie in their request headers? Also, are these requests made by the page’s JavaScript in the browser, or by something else, such as a service worker, a separate app or a server-side script? The article says only requests from a browser that runs the page’s JavaScript and keeps its cookies get through. --- _[View the full topic](https://forum.infinityfree.com/t/javascript-verification-challenge-blocking-messaging-api-requests/121482)._