🎧 Listen to this article (3 min)
I recently ran into a frustrating WordPress problem. I was trying to update some PHP using the Code Snippets plugin, but when I tried to save the change, I received a 403 Forbidden error.
What made it particularly confusing was that everything had been working perfectly before. I had edited and saved snippets without any problems only a day or two earlier.
So what had changed?
I never established exactly what triggered the error. What I did discover was that the WPMU DEV Web Application Firewall (WAF) protecting my website was blocking the request.
What was actually blocking it
A WAF sits between incoming requests and your website and attempts to block potentially malicious activity. That’s an important layer of protection, but occasionally legitimate administrator activity can get caught too.
In my case, I was trying to save PHP through the WordPress admin area. When the WAF was active, the request resulted in a 403 error. When I removed that layer temporarily, the snippet saved successfully.
The security system protecting the website was also preventing the administrator from making a legitimate change.
That doesn’t mean every 403 error when using Code Snippets is caused by a firewall. No two WordPress setups — or problems — are exactly the same.
Before changing any security settings, I’d try something much simpler first: refresh the WordPress admin page and try again.
If the 403 persists, then your firewall or security tools are worth investigating.
My first solution: whitelist my IP address
The first time this happened, I solved the problem by adding my IP address to the firewall’s whitelist.
That worked and allowed me to save the snippet.
When I encountered the problem again, however, I used a more convenient temporary workaround.
What I did instead
I temporarily disabled the WAF, returned to Code Snippets and saved my changes.
Once I’d checked that everything was working, I immediately turned the WAF back on.
That last step matters. Disabling the firewall isn’t a fix I’d recommend leaving in place. It’s a temporary workaround that allowed me to make a trusted administrative change.
While the WAF is disabled, that layer of protection isn’t there for other traffic reaching the website either. That’s why I kept the window as short as possible.
If the problem happened frequently, I’d investigate the firewall configuration further rather than repeatedly switching it off.
What I learned
A 403 error doesn’t necessarily mean WordPress, Code Snippets or your PHP is broken.
Something else in your hosting or security setup may simply be refusing the request.
When something that worked yesterday suddenly stops working today, don’t immediately assume the thing you’re working on is broken. Think about the other layers surrounding it.
In my case, temporarily disabling the WAF confirmed where the problem was coming from and allowed me to continue working.
The important thing was knowing where to look next.
And in this case, that stopped me spending ages debugging perfectly good PHP and let me get back to solving the WordPress problem I was actually trying to fix.
