Now, according to WordPress resource site WPBeginner, 403 errors occur when server permissions don’t allow access to a specific page.
But what does a 403 error mean, and why is it occurring in Page Builder Sandwich in the first place?
The 403 Error Explained
The most common cause of the 403 error is when security plugins aren’t configured in a particular way or standard.
And like WordFence, most security plugins from WordPress restrict some actions if they’re suspected or proven to be malicious. These scenarios usually occur on your WP Admin or WP Login page, or show up as pop-ups alerting you that you don’t have authorization to view your page.
Here’s what the pop-up will usually look like if you ever encounter it on Sandwich:
WordFence is Legit…
WordFence is one of the most popular security plugins for WordPress. It has over a million active installs, so chances are, it’s probably installed on your WP website, too. They exist for a great cause: not to just keep your website safe, but to also reduce security risks, and improve your website’s security overall.
tl;dr WordFence is legit.
…And So is Sandwich. But Why Does It Need Whitelisting?
It’s not just Sandwich that it blocks. Other plugins and URLS require whitelisting (the inverse of blacklisting) on WordFence, too. Some more popular plugins might have been allowed already by Wordfence.
So what’s happening behind the scenes, and where is the 403 error coming from?
Ajax Functions and Page Builder Sandwich
Page Builder Sandwich performs ajax functions throughout your editing experience. Certain plugins do to.
W3Schools expounds on ajax a little further:
AJAX is a technique for creating fast and dynamic web pages. It allows web pages to be updated asynchronously by exchanging small amounts of data with the server behind the scenes. This means that it is possible to update parts of a web page, without reloading the whole page.
In Page Builder Sandwich, the ajax calls range from getting shortcode mappings, rendering shortcodes to saving your changes. This might cause you to experience problems , such as the 403 error, problems with saving your output, or unrendered shortcodes. This is the time that you might need to whitelist ajax calls specific to Page Builder Sandwich.
Whitelisting Page Builder Sandwich on WordFence
To white list PBS in Wordfence’s Firewall, add an entry in the Whitelisted URLs area with these parameters:
Param Name: main-content
Param: POST Body
For multisite WordPress installations though, it’s a good idea to include your site’s folder name in the URL above. For example: /my-multisite/wp-admin/admin-ajax.php
After adding these values, the 403 Error should be properly addressed, and you should be able to save your output and generate rendered shortcodes again.
This is what it should look like under your WordFence Firewall settings:
Yes, Page Builder Sandwich is safe to use. More than that, it only performs ajax actions when in editing mode, and it’s compatible with external plugins and themes (as long as they’re at par with WordPress’ coding standards).
WordFence Security is no different.
But what’s great about them is they give WordPress users the opportunity to keep their sites safe and secure, with the additional option to let you decide which plugins are, and aren’t.