# Mobile browsers receive 403 from /aes.js browser-security challenge, desktop works **URL:** \ **Category:** Hosting Support\ **Created:** [September 23, 2026, 11:55am UTC](https://forum.infinityfree.com/t/mobile-browsers-receive-403-from-aes-js-browser-security-challenge-desktop-works/120876 "2026-09-23T11:55:41Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![Admin](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/admin/32/36437_2.png) [@Admin](https://forum.infinityfree.com/u/Admin)\ **Post date:** [September 23, 2026, 7:21pm UTC](https://forum.infinityfree.com/t/mobile-browsers-receive-403-from-aes-js-browser-security-challenge-desktop-works/120876/2 "2026-09-23T19:21:34Z")
I spent more time than I should on this issue, but it was a strange case that piqued my curiosity. But I’m happy to say I found the issue: Your website is infected with malware. ### What’s going on It’s not a hosting problem. There is a hidden plugin in your website in the `iframe-redirect` folder that hijacks the page requests and shows a full screen iframe referring to another website. And that other website is returning the 403 error you see. It’s not from our hosting and not from Cloudflare (neither of us use `nginx/1.30.4`, that was the tell for me). The reason that this only affects mobile users is because desktop users are seeing cached versions of the page before the infection, but your amp redirect plugin adds `?amp=1` to the URL, which causes WordPress to ignore the cache and trigger the malware. Keep in mind that: - The plugin seems to be hiding itself deliberately from the WordPress admin area. You will probably not see it in the plugins list. - The plugin seems to be blocking logins to the admin area. If you tried logging in and got a message saying “Cookies are blocked due to unexpected output”, that’s not WordPress or your browser, that’s the malware locking you out. ### What to do now Do all of these steps. Don’t skip any because your website works again. If you don’t fully close the door that the attacker got into, they can just infect your website again. 1. Using the File Manager or FTP, find the plugin in `wp-content/plugins` and delete its folder. You can’t do this through your WordPress admin area. 2. Check your admin users. If you can’t log in yet, check the `wp_users` table in phpMyAdmin. Delete any user you don’t recognize. 3. Change all passwords: your WordPress admin accounts, your InfinityFree account, and your FTP and database passwords. Note that you’ll need to update the wp-config.php file too with the new password. 4. Reinstall WordPress, all plugins and your theme from clean copies, meaning the latest versions downloaded from the official sources. The malware got onto your site somehow, meaning there may be more malicious code in your website that we haven’t found yet. Pay particular attention to PHP files in `wp-content/uploads` (there shouldn’t be any) and any files you don’t recognize. 5. Update everything to the latest version, and remove plugins and themes you don’t use. 6. Clear your caches, both in WordPress and in Cloudflare (purging cache in Cloudflare won’t clear the cache in WordPress). You can also remove the Cloudflare cache bypass rule you created, since it’s not needed. ### Closing note Just to be clear: the security system was never the issue in the first place. It’s enabled on all free hosting websites and cannot be disabled. But it works fine for all remotely modern browsers, including mobile browsers, and works fine with WordPress and Cloudflare too. And the `?i=1` URL suffix is a key part of the security system, not something that interferes with it. --- _[View the full topic](https://forum.infinityfree.com/t/mobile-browsers-receive-403-from-aes-js-browser-security-challenge-desktop-works/120876)._