# PHP API requests blocked by JavaScript security challenge **URL:** \ **Category:** Hosting Support\ **Created:** [October 20, 2026, 5:03pm UTC](https://forum.infinityfree.com/t/php-api-requests-blocked-by-javascript-security-challenge/121461 "2026-10-20T17:03:50Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![SafdarPKChat](https://forum.infinityfree.com/letter_avatar/safdarpkchat/32/5_5575768a8748004e209b776fc1b2916d.png) [@SafdarPKChat](https://forum.infinityfree.com/u/SafdarPKChat)\ **Post date:** [October 20, 2026, 5:03pm UTC](https://forum.infinityfree.com/t/php-api-requests-blocked-by-javascript-security-challenge/121461/1 "2026-10-20T17:03:50Z")
### Website URL ttps://pkchat.freedev.app ### Error Message Connection reset by peer. Termux curl and Python requests receive a JavaScript security challenge instead of the API response. ### Other Information Website: [https://pkchat.freedev.app](https://pkchat.freedev.app) My PHP test API works in Chrome and returns JSON successfully. However, requests from Termux using curl and Python requests are blocked by a JavaScript security challenge or the connection is reset. API endpoints: - [https://pkchat.freedev.app/api/test.php](https://pkchat.freedev.app/api/test.php) - [https://pkchat.freedev.app/api/send\_otp.php](https://pkchat.freedev.app/api/send_otp.php) - [https://pkchat.freedev.app/api/verify\_otp.php](https://pkchat.freedev.app/api/verify_otp.php) I am developing an Android chat app that needs to send JSON POST requests to these endpoints. Is there a supported way to use these APIs on InfinityFree hosting without the browser JavaScript challenge? ---
**Author:** ![system](https://infinityfree-forum-uploads.s3.dualstack.eu-central-1.amazonaws.com/original/3X/b/0/b024fd3fa88bae093c9576e55c2c94e33f890206.svg) [@system](https://forum.infinityfree.com/u/system)\ **Post date:** [October 20, 2026, 5:03pm UTC](https://forum.infinityfree.com/t/php-api-requests-blocked-by-javascript-security-challenge/121461/2 "2026-10-20T17:03:51Z")
Welcome to the InfinityFree community forum! Good to have you here. - Most people answering here are volunteers. They’re often the fastest source of help. Admin (the only staff member) checks in about once a day for issues on our end. - Volunteers can’t see your account or website. Share what you actually see, like error messages and what happens when you try something. That’s more useful than your theory of what’s wrong. - AI tools often get InfinityFree wrong. If a volunteer’s advice differs from what an AI told you, please try the volunteer’s suggestion first. - Solving an issue is a joint effort. Try the suggestions you get and report back what happened. ---
**Author:** ![Lemni](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/lemni/32/68303_2.png) [@Lemni](https://forum.infinityfree.com/u/Lemni)\ **Post date:** [October 20, 2026, 5:04pm UTC](https://forum.infinityfree.com/t/php-api-requests-blocked-by-javascript-security-challenge/121461/3 "2026-10-20T17:04:03Z")
_Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look._ There isn’t a supported way to do this on InfinityFree’s free hosting. The JavaScript challenge you’re seeing is a mandatory security system on all free accounts, and it can’t be turned off. The system only lets through clients that can run JavaScript and keep a cookie, which a real browser does. Chrome passes it for that reason. Termux curl and Python requests can’t run JavaScript, so they get the challenge page instead of your JSON. The article says this applies to every URL on the site, and you can’t exempt a path, a file type, a user agent or an IP address. Using your own domain doesn’t change it either. The article lists Android and iOS apps, REST APIs and command-line tools like cURL as things that won’t work against a free hosting account. Your PHP code never runs for those requests, so changing the scripts won’t help. If the response you get back contains `aes.js`, that confirms the challenge is what’s stopping the request. The article’s suggestion for sites that need app or API access is [premium hosting](https://www.infinityfree.com/premium/), which protects the site with less restrictive methods. Mobile apps, APIs and automated tools work normally there. Here’s the article, with the full list of what is and isn’t affected: > [@Browser Security System - Features and Limitations](https://forum.infinityfree.com/docs?topic=49353): > > InfinityFree uses a security system on all free hosting accounts to ensure your website is accessed by real web browsers, not bots or automated scripts. While this protects your site from malicious traffic, it can affect certain types of access. How the security system works The system checks that visitors can execute JavaScript and accept cookies: features that all modern web browsers support. This verification happens automatically and most website visitors will never notice it. You may occa… ---
**Author:** ![EdwardSkunk](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/edwardskunk/32/66982_2.png) [@EdwardSkunk](https://forum.infinityfree.com/u/EdwardSkunk)\ **Post date:** [October 20, 2026, 5:28pm UTC](https://forum.infinityfree.com/t/php-api-requests-blocked-by-javascript-security-challenge/121461/4 "2026-10-20T17:28:52Z")
The bot is absolutely correct. What you’re trying to do cannot be accomplished on free hosting. > [@Browser Security System - Features and Limitations](https://forum.infinityfree.com/docs?topic=49353): > > InfinityFree uses a security system on all free hosting accounts to ensure your website is accessed by real web browsers, not bots or automated scripts. While this protects your site from malicious traffic, it can affect certain types of access. How the security system works The system checks that visitors can execute JavaScript and accept cookies: features that all modern web browsers support. This verification happens automatically and most website visitors will never notice it. You may occa… > [@SafdarPKChat](#): > > Is there a supported way to use these APIs on InfinityFree hosting without the browser JavaScript challenge? No. It’s also worth pointing out that running an instant messaging or online chat service is prohibited on InfinityFree regardless.