Wordfence Blocking Divi Cloud AJAX Requests

  • Resolved elkrat

    (@elkrat)


    2 years, 2 months ago

    Wordfence is blocking AJAX requests from the Divi Cloud module. I’m editing the page in wireframe mode.
    Request:
    action "et_fb_get_cloud_item_content"
    Response is 403 with the Allowlist button, which is of course only visible in the console. Here is the data that would be transmitted with that Allowlist form submission:
    <input type="hidden" name="wfwaf-false-positive-params" value="[{&quot;path&quot;:&quot;\/wp-admin\/admin-ajax.php&quot;,&quot;paramKey&quot;:&quot;request.body[et_layout_content]&quot;,&quot;ruleID&quot;:9}]">

    I put the firewall into learning mode and it went through.

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Support wfpeter

    (@wfpeter)

    Hi @elkrat,

    Crucially, does the request go through after returning from Learning Mode to Enabled and Protecting? If it does, this means a false-positive was being picked up and needed to be allowed using this method. This does happen from time-to-time with some plugin actions on some sites but should be resolved after the firewall has learnt that you wish the communication to go ahead.

    The manual allowlist button either during the communication in question, or from the block entry on your Live Traffic page should also have a similar effect when clicked. Only administrators can do this in either scenario, so your site visitors wouldn’t have seen it.

    Thanks,

    Peter.

    Thread Starter elkrat

    (@elkrat)

    It’s still in the learning mode period, but I can see the param request.body[et_layout_content] has been correctly listed at this point. So I’d say it’s resolved, but the method of resolution was not intuitive. As a user, it just appeared that I pushed the button and it didn’t work.

    Plugin Support wfpeter

    (@wfpeter)

    Hi @elkrat,

    That sounds good, although make sure to return the site to Enabled and Protecting when you’re done with your testing. Let me know if you continue to have issues afterwards, even after attempting a manual allowlist through the Live Traffic.

    I will pass on your comments to the development team to see if there’s anything we need to add to the flow to more obviously acknowledge the button presses.

    Peter.

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Wordfence Blocking Divi Cloud AJAX Requests’ is closed to new replies.