Title: Text “<script" cannot be saved with 403 error
Last modified: May 29, 2023

---

# Text “<script" cannot be saved with 403 error

 *  Resolved [Will Mayall](https://wordpress.org/support/users/willmayall/)
 * (@willmayall)
 * [3 years ago](https://wordpress.org/support/topic/text-script-cannot-be-saved-with-403-error/)
 * The following line cannot be saved. It appears that ‘<‘ followed by ‘script’ 
   generates a 403 error.
 * $result = “<script”;

Viewing 8 replies - 1 through 8 (of 8 total)

 *  Plugin Author [Shea Bunge](https://wordpress.org/support/users/bungeshea/)
 * (@bungeshea)
 * [3 years ago](https://wordpress.org/support/topic/text-script-cannot-be-saved-with-403-error/#post-16777945)
 * Hi Will, do you happen to have any security software installed that might be 
   catching this and blocking the request?
 *  Thread Starter [Will Mayall](https://wordpress.org/support/users/willmayall/)
 * (@willmayall)
 * [3 years ago](https://wordpress.org/support/topic/text-script-cannot-be-saved-with-403-error/#post-16779759)
 * I assume you are suggesting that something — probably a plugin — is trying to
   prevent a code injection. That certainly seems reasonable.
 * Sucuri is installed but has been installed for years and before the script was
   originally created. I tried it with Sucuri off and the problem remained.
 * I know Jetpack has security tests as well but assume the issue would be appearing
   for others.
 * The one big change was a recent update from Ubuntu 18LTS to 22LTS but I had not
   edited the code for years so I think that was simply coincidental.
 * I know the following can be used as a workaround:
 * $result = “<“;
   $result .= “script”;
 * I updated the script directly in the db.
 * If you have other ideas, that would be great. Thanks for your support.
 *  Plugin Author [Shea Bunge](https://wordpress.org/support/users/bungeshea/)
 * (@bungeshea)
 * [3 years ago](https://wordpress.org/support/topic/text-script-cannot-be-saved-with-403-error/#post-16779859)
 * We could try escaping HTML entities before sending the payload, and then reconstructing,
   but I’d worry about potentially malforming the code data.
 *  Thread Starter [Will Mayall](https://wordpress.org/support/users/willmayall/)
 * (@willmayall)
 * [3 years ago](https://wordpress.org/support/topic/text-script-cannot-be-saved-with-403-error/#post-16780247)
 * Were you able to reproduce the issue? I could create a test site to try.
 * What is puzzling to me is that I found the issue when editing an old script. 
   The script used to allow the “<script” text. Clearly something changed somewhere,
   perhaps in WordPress itself.
 *  Thread Starter [Will Mayall](https://wordpress.org/support/users/willmayall/)
 * (@willmayall)
 * [3 years ago](https://wordpress.org/support/topic/text-script-cannot-be-saved-with-403-error/#post-16780272)
 * I just created a clean WordPress install and the issue does not appear. I’ll 
   try adding some plugins and see if I can find a conflict.
 *  Thread Starter [Will Mayall](https://wordpress.org/support/users/willmayall/)
 * (@willmayall)
 * [3 years ago](https://wordpress.org/support/topic/text-script-cannot-be-saved-with-403-error/#post-16780530)
 * On the production site, I thought I’d try entering “<script” in another field.
   I did it in a search field. The server blocked the entry with a 403 error.
 * At this point, I’m assuming there is a server level protection trying to block
   code injection.
 * You can mark this issue as closed since the issue is not specific to Code Snippet.
 * Again, thanks for your excellent support.
 *  Thread Starter [Will Mayall](https://wordpress.org/support/users/willmayall/)
 * (@willmayall)
 * [3 years ago](https://wordpress.org/support/topic/text-script-cannot-be-saved-with-403-error/#post-16780548)
 * A WAF (ModSecurity) with Comodo rules is causing the error.
 * I have two very similar sites that both exhibited the error. Turning off the 
   WAF eliminated the error.
 *  Plugin Author [Shea Bunge](https://wordpress.org/support/users/bungeshea/)
 * (@bungeshea)
 * [2 years, 11 months ago](https://wordpress.org/support/topic/text-script-cannot-be-saved-with-403-error/#post-16835469)
 * Glad you could get it sorted!
 * Even though it’s technically an external issue, we’re working on a patch that
   will hopefully reduce the problems with modsecurity, by escaping code tags and
   other special characters that it appears to be flagging.

Viewing 8 replies - 1 through 8 (of 8 total)

The topic ‘Text “<script" cannot be saved with 403 error’ is closed to new replies.

 * ![](https://ps.w.org/code-snippets/assets/icon.svg?rev=2148878)
 * [Code Snippets](https://wordpress.org/plugins/code-snippets/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/code-snippets/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/code-snippets/)
 * [Active Topics](https://wordpress.org/support/plugin/code-snippets/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/code-snippets/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/code-snippets/reviews/)

 * 8 replies
 * 2 participants
 * Last reply from: [Shea Bunge](https://wordpress.org/support/users/bungeshea/)
 * Last activity: [2 years, 11 months ago](https://wordpress.org/support/topic/text-script-cannot-be-saved-with-403-error/#post-16835469)
 * Status: resolved