If you're editing in WordPress, working with widgets, and get an error while saving, you're running into WordFence's firewall. It's meant to protect your WordPress site from outside attacks, but sometimes can get a bit over aggressive and block you as well! It has a learning mode that will allow more things in the first week after you set up, but if you don't add widgets in that time it will block the action because it doesn't recognize it.
If you're using Elementor, the error will look something like this. Similar errors may happen with other builders and the fix is the same.
To fix this, go to WordFence in your WordPress admin and whitelist the save request so it can include widgets.
Method 1 - whitelist admin-ajax.php
- Go to Wordfence > All Options
- Go down to the Whitelisted URLs section
- Enter
/wp-admin/admin-ajax.phpin the URL box - Select
Param Type: POST Bodyfor the dropdown - Enter
actionsfor the Param Name - Click the Add button
- Click Save Changes in the top right corner
Method 2 - whitelist by recent traffic
If the first method didn't work or there is a different request involved, you can find the traffic that happens at the time you receive the 403 and whitelist that.
- Go to WordFence
- Click on Tools inside the WordFence menu
- Click on Live Traffic. This view shows recent traffic to your site.
- Filter the traffic to "Blocked By Firewall".
- Click on the request you just made to save the page in your page builder -- it'll usually be the most recent request and from your general area
- Double check that it was actually you making the request
- Whitelist the request
That's it! Now you can go back to the page builder and add your widgets.