A 403 forbidden error means something refused the request before ExactFind could answer it. It's usually a firewall, a security plugin or a site setting.
Find the failing request
- Open the page with the search box.
- Open your browser's developer tools and go to the Network tab.
- Ask a question.
- Find the request to
/wp-json/exactfind/v1/answer, or/wp-json/exactfind-knowledge/v1/chatwith Knowledge. - Check its status and response.
Messages from ExactFind
| Response | Cause | Fix |
|---|---|---|
| "This request isn't allowed from another site" | The request came from a different domain | Check your WordPress and site addresses match your real domain |
| "Please complete the check to continue" | The Turnstile check failed or didn't load | Check both Turnstile keys, that your domain is allowed in Cloudflare, and that your Content Security Policy allows Turnstile |
| "Sorry, you are not allowed to do that." | Logged-in users only is on, and the visitor isn't signed in | Sign in, or turn the setting off |
If your site also runs on another domain, a developer can add it with the exactfind_allowed_origins filter.
Wordfence and other security plugins
Check your security plugin's firewall log for a block at the time of your test. In Wordfence, use Firewall > Blocking and Tools > Live Traffic. If you find a false positive, allow it for the ExactFind routes.
Cloudflare
Go to Security > Events in your Cloudflare dashboard and look for the request. If a rule blocked it, add an exception for these paths:
/wp-json/exactfind/v1/answer
/wp-json/exactfind-knowledge/v1/chatYour host
Some hosts block the WordPress REST API or use their own firewall. If you can't find the block yourself, ask your host, and give them the paths above.
Content Security Policy
A Content Security Policy is a header that tells browsers which scripts and frames a page may load. Security plugins, hosts and Cloudflare can add one. It doesn't cause a 403, but it can stop ExactFind working in the browser. Look for errors that mention the policy in your browser's Console tab.
With bot protection on, ExactFind loads Cloudflare's Turnstile script from https://challenges.cloudflare.com/turnstile/v0/api.js, and the check runs in a frame from the same address. Your policy must allow it in both places:
script-src 'self' https://challenges.cloudflare.com;
frame-src https://challenges.cloudflare.com;Add https://challenges.cloudflare.com to the script-src and frame-src you already have rather than replacing them. If it's missing, the check never appears, and questions fail with "Please complete the check to continue".
Also check that your policy:
- Allows your own site in
connect-src, or has noconnect-src, so questions can reach the ExactFind routes. - Allows inline scripts, or adds a nonce to WordPress's inline scripts. ExactFind passes its settings to the page in a short inline script, as most WordPress plugins do. If that script is blocked, the search box shows but doesn't answer.
Don't turn the firewall off
Keep your firewall on and allow only these paths. ExactFind's own limits still protect them.