A website I run is receiving a 403 error on normal mobile browsers, but it works when I use Desktop Site/Desktop Mode.
(the blog pages only have this issue)
Problem:
Android mobile browsers receive a 403 blocked page.
iPad mobile browsers also receive a 403.
Desktop browsers work normally.
Enabling Desktop Site on the phone allows the website to load.
The challenge response appears to reference /aes.js.
The failed request redirects or includes ?i=1.
This appears to be InfinityFree’s browser-security challenge.
I am using Cloudflare for DNS/proxying. I created a Cloudflare Cache Rule with:
Cache eligibility: Bypass cache
Match: All incoming requests
I also purged the Cloudflare cache. The problem still occurs on mobile.
Cloudflare Security Events do not show a corresponding blocked request, so I suspect the 403 is being generated by the InfinityFree hosting-layer browser-security system rather than by Cloudflare.
Could you please check whether:
The /aes.js browser challenge is failing for mobile browsers;
This domain can be exempted from the browser-security challenge; or
There is a known issue with mobile clients, Cloudflare proxying, or requests containing ?i=1?
Please let me know if you need the full error page, response headers, or additional test details.
I spent more time than I should on this issue, but it was a strange case that piqued my curiosity. But I’m happy to say I found the issue:
Your website is infected with malware.
What’s going on
It’s not a hosting problem. There is a hidden plugin in your website in the iframe-redirect folder that hijacks the page requests and shows a full screen iframe referring to another website. And that other website is returning the 403 error you see. It’s not from our hosting and not from Cloudflare (neither of us use nginx/1.30.4, that was the tell for me).
The reason that this only affects mobile users is because desktop users are seeing cached versions of the page before the infection, but your amp redirect plugin adds ?amp=1 to the URL, which causes WordPress to ignore the cache and trigger the malware.
Keep in mind that:
The plugin seems to be hiding itself deliberately from the WordPress admin area. You will probably not see it in the plugins list.
The plugin seems to be blocking logins to the admin area. If you tried logging in and got a message saying “Cookies are blocked due to unexpected output”, that’s not WordPress or your browser, that’s the malware locking you out.
What to do now
Do all of these steps. Don’t skip any because your website works again. If you don’t fully close the door that the attacker got into, they can just infect your website again.
Using the File Manager or FTP, find the plugin in wp-content/plugins and delete its folder. You can’t do this through your WordPress admin area.
Check your admin users. If you can’t log in yet, check the wp_users table in phpMyAdmin. Delete any user you don’t recognize.
Change all passwords: your WordPress admin accounts, your InfinityFree account, and your FTP and database passwords. Note that you’ll need to update the wp-config.php file too with the new password.
Reinstall WordPress, all plugins and your theme from clean copies, meaning the latest versions downloaded from the official sources. The malware got onto your site somehow, meaning there may be more malicious code in your website that we haven’t found yet. Pay particular attention to PHP files in wp-content/uploads (there shouldn’t be any) and any files you don’t recognize.
Update everything to the latest version, and remove plugins and themes you don’t use.
Clear your caches, both in WordPress and in Cloudflare (purging cache in Cloudflare won’t clear the cache in WordPress). You can also remove the Cloudflare cache bypass rule you created, since it’s not needed.
Closing note
Just to be clear: the security system was never the issue in the first place. It’s enabled on all free hosting websites and cannot be disabled. But it works fine for all remotely modern browsers, including mobile browsers, and works fine with WordPress and Cloudflare too. And the ?i=1 URL suffix is a key part of the security system, not something that interferes with it.