403 Forbidden Error when updating plugin

  • dpsheen
    October 1, 2026 at 2:53 am

    Hi there,

    I have recently renewed my GeneratePress Premium license, and I have an issue with updating the plugin. I can’t see any updates being flagged in WordPress, and when I try to update the license key I get a 403 forbidden error.

    I have checked over everything on my side including:

    – Any blocks on my server
    – Made sure curl was installed
    – Updated PHP version to 8.3

    When I try to run curl -I https://generatepress.com I get the following:

    HTTP/2 403 
date: Thu, 01 Oct 2026 09:44:41 GMT
content-type: text/html; charset=UTF-8
content-length: 5408
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cf-mitigated: challenge
content-security-policy: default-src 'none'; script-src 'nonce-AfG8CJC5MHdd34jIWr3dbj' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
server: cloudflare
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*
referrer-policy: same-origin
server-timing: chlray;desc="a43a87b91e7cd371"
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
set-cookie: __cf_bm=O.95z4tXNOfgeQfDqOsNc4yqQnr8Pv.tQ96r_ErYQHw-1790847881.1399481-1.0.1.1-FHvEh3GFl8j8zN7Yk5_2ElDB_VLwc4EvH47WalURfM9vyrqe_GbvZFHi8xjUOodKXXqx7fysAmTBbPhAUxxgExYYAyzfbvYFsITy.Lc6438m6aSRgawtkLnf1jkRW2qx; HttpOnly; SameSite=None; Secure; Path=/; Domain=generatepress.com; Expires=Thu, 01 Oct 2026 10:14:41 GMT
cf-ray: a43a87b91e7cd371-FRA
alt-svc: h3=":443"; ma=86400

    So it does look like my server is being blocked by CloudFlare on GeneratePress’s end. Would you be able to check and unblock my server IP? I have provided this IP in the private information section.

    Thank you!

  • George
    October 1, 2026 at 3:40 am

    Hi,

    Thanks for the detailed testing — that helps.

    One thing worth clarifying about the curl output: cf-mitigated: challenge is a managed challenge rather than an IP block. A plain curl -I using curl’s default user agent will generally get challenged on our main site no matter where the request comes from, so that result doesn’t confirm your server’s IP has been blocked. The end result is the same for you, though — WordPress’s activation request can’t solve a challenge, so it comes back as a 403.

    We built a secondary API specifically for this situation. api.generatepress.com doesn’t sit behind the same challenge layer, so requests routed through it go through normally. Please add the snippet from this doc:

    https://docs.generatepress.com/article/license-key-activation-issues/#secondary-api

    The easiest way to add it is with the Code Snippets plugin, or your child theme’s functions.php if you prefer.

    After doing that, please remove your license key, then re add it and Save Key again.

  • dpsheen
    October 3, 2026 at 11:29 am

    Hello George,

    Thank you so much for that fix, this has worked for me.

    All the best,
    Daniel

  • George
    October 4, 2026 at 6:00 am

    Great to hear, no problem!

Viewing 4 posts - 1 through 4 (of 4 total)
  • You must be logged in to reply to this topic.