Website URL https://ahhqart.xo.je/wp-json/wp/v2/posts Error Message ‘Connection aborted.’, RemoteDisconnected(‘Remote end closed connection without response’,) Other Information Server seems to mistake requests to WordPress REST API for spam, most likely due to the user agent, which was python-req…

Yes, this is likely from the security system. [image] Why isn't API access working on my website? InfinityFree uses a security system that requires JavaScript and cookies to access websites. APIs and automated tools typically can’t execute JavaScript or store cookies, so they get blocked by the …

But it is NOT guaranteed that the security system will stop bots. For example, bots can hide behind identity of real clients by capturing browser requests and injecting JavaScript payload in HTML response. This way, bots can easily access anti-bot cookies, headers assigned by the security system its…

Yes, and bots running off of headless browsers will be allowed through with no extra effort. But most bots aren’t that sophisticated because that gets expensive. Most of them are just basic automated HTTP crawlers that can’t set cookies or execute JavaScript, and that’s what the security system is s…

“Automated attacks” are not “basic automated HTTP crawlers” and are not necessarily expensive. As you can see, I bypassed it just by changing UA. No cookies, no headers sent, yet it worked because the ?i=1 thing is NOT applied in API endpoints.

The security system, along with the IP blocking system does a pretty good job of blocking many automated attacks. However, I would say that by circumventing this system you’re running the risk of being in breach of the InfinityFree TOS… But ultimately, that’s admins decision so don’t take my word f…

Sorry, my mistake. I misread your initial post. I agree that’s a pretty big opening and is definitely a flaw in the security system. I’m sure Admin will appreciate you bringing it to their attention.

I’m not trying to circumvent anything. I’m just saying the security system is not enough to stop bots. Because non-techy readers would miscomprehend the article and think CAPTCHAs are redundant. And I don’t think posting to WordPress REST API does violate InfinityFree’s ToS, specifically this claus…

[image] ldaelo: I don’t think posting to WordPress REST API does violate InfinityFree’s ToS No, but circumventing the security system does. Ultimately though, its admin’s decision if this constitutes deliberately circumventing the security system. If you look at this post from Admin: …

[image] ldaelo: InfinityFree server, if I’m not mistaken, is optimized to host WordPress sites… No, not specifically. You can host them on InfinityFree because WordPress is decently universal and only requires PHP and SQL. But that’s different from a host being “optimized” for WordPress. You …

If an API is being blocked, it can throw all sorts of strange errors, or can simply disconnect. No. The server should respond with 403 Forbidden when normal request was blocked or the endpoint was restricted, indicating that it was security-related and was just not random bugs. Even some law requ…

Server blocks requests to WordPress REST API

Hosting Support

twineee.rf.gd December 6, 2025, 2:39pm 2

Yes, this is likely from the security system.