403 when saving GetYourGuide script via WPVibe; normal edits work

Hi there,

Thank you for including the Ray ID and checking the same change directly in WordPress.

I confirmed that caaarpe-dieeem.com uses Cloudflare and is running WPVibe 1.17.0. Public connectivity checks pass through both WPVibe paths. A security rule rejecting the script-containing update is a possibility, but those checks do not test that write, and the HTML response and Ray ID alone do not identify which layer or rule blocked it. WPVibe does not have a blanket block on GetYourGuide widgets.

Please open Cloudflare’s Security Events for the time of the failed request and look for Ray ID a3be6bc01c520261 (shown in your response with the -CDG suffix). If your host manages Cloudflare, ask them to check it.

If the event confirms that a rule blocked the direct WPVibe Worker request, and the request path is /wp-json/wpvibe/v1/content/edit, this expression limits an exception to WPVibe’s POST requests to that endpoint on your site:

(http.host eq "caaarpe-dieeem.com"
 and cf.worker.upstream_zone eq "wpvibe.ai"
 and http.request.method eq "POST"
 and http.request.uri.path eq "/wp-json/wpvibe/v1/content/edit")

This is the match expression; the right action depends on the blocking rule:

• Managed WAF rule: use it for an exception to only the rule ID shown in the event.
• Custom rule: exclude this match from that rule using (EXISTING_RULE_EXPRESSION) and not (EXCEPTION_MATCH), keeping the rest of the rule and its action.
• Super Bot Fight Mode: use a Skip rule selecting only that product. Regular Bot Fight Mode cannot be bypassed with a WAF Skip rule.

Please confirm the request details before adding it. If the URL uses ?rest_route= instead, the expression needs a different path and query match. If the blocked request came through our relay, it needs the verified relay source IP instead of the Worker identity. The example above will not cover those requests.

Please email support@wpvibe.ai with the event’s rule ID, security product, action, source IP and request path/query, plus the failure time, timezone and your WPVibe account email. Remove any credentials or tokens from what you send. Those details will let me tailor the exception to the actual blocked request. Please don’t disable the whole firewall or bypass protection for every WordPress API request.

You can use the manual WordPress edit you already tested while we investigate. Please post back here once you’ve emailed so I can connect the two conversations.

Thanks,
John

Hi Suguru,

Thank you for sending those details and confirming here. We can continue the investigation by email, so there’s no need to post account information here.