Hi @michabbs
Thank you for your message.
I understand that the issue is occurring on your store. Could you please provide more details about it? In particular:
- Could you describe step by step what actions are taken before the 403 error appears?
- Does the issue occur every time, or only in specific cases?
- Are there any additional logs or error messages available (e.g., from the server or browser console)?
Additionally, could you please share your current environment details:
- WordPress version
- WooCommerce version
- PHP version
- Plugin version
This information will help us better understand the issue and investigate it more effectively.
My account page -> Orders -> click on one of the old orders -> click “Refund Request”
Effect:
– 403 error is shown in the browser [bad!]
– refund request emails are correctly sent [good!]
– the order status is changed and it appears in the list of refund pending orders in the WooCommerce panel [good!]
Apache log:
“POST /moje-konto/fr-refund/671/ HTTP/2” 301 0 “https:///moje-konto/fr-refund/671/” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36” “GET /moje-konto/fr-refund/671/?request=send HTTP/3” 403 0 “https:///moje-konto/fr-refund/671/” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36”
WordPress version: 6.9.4
WooCommerce version: 10.6.2
PHP version: 8.4.18
Plugin version: 1.0.49
Could you go to WordPress > Permalinks? Go to that panel, don’t change anything there, just click the ‘Save Changes’ button. Is the problem still occurring?
If so, select one of the available options in the Permalinks panel and save the changes. Is the problem still occurring?
Tried 2 different settings. No change. 🙁
Ok
To help identify the root cause of the issue, please follow these steps:
- Check for redirects
- Open the URL
/moje-konto/fr-refund/671/ and verify if it triggers a redirect (301).
- Disable security plugins temporarily
- Turn off plugins like Wordfence or other firewalls and test again.
- Verify nonce parameter
- Make sure the request includes a valid
_wpnonce value.
- Test without cache/CDN
- Disable any caching plugins (e.g. LiteSpeed, WP Rocket) and CDN (e.g. Cloudflare), then retry.
- Reproduce the issue step by step
- Try submitting the refund request again and note exactly when the error appears
Please let me know the results of these checks.
All-In-One Security (AIOS) was the reason.
Disablling optiion “Block Bad/Malicious Query Strings” helped.
Great 😉
I’m glad you managed to solve the problem. I’m marking this thread as resolved.
