HOST141: Search blocked by waf
What this means
The host's security filter is blocking product searches.
A firewall rule on this host rejects REST requests whose query string contains non-ASCII characters or SQL-looking words. Product names with accents, and searches containing words like 'select' or 'union', will fail with a 403 even though they are ordinary catalogue searches. The till works otherwise; searches will be unreliable until the rule is relaxed.
What to do
Export diagnostics and contact support. Retry after making the change above; retrying without it will fail the same way.
Your data
No order or product data is affected.
Troubleshoot
- Ask the host to allow-list the store's own REST search parameters (/wcpos/ and /wc/ routes) in the query-string firewall rules.
- On OWASP CRS-based firewalls, the SQL-injection rules on the 's' and 'search' arguments are the usual culprits — exclude those arguments for REST API routes.
- Security plugins with a 'filter suspicious query strings' toggle need an exception for the REST API, not a global off switch.
Where to look
When WCPOS can save this error, it is recorded on the device that raised it. Open Store health → Logs (the heart-pulse icon at the bottom of the navigation drawer), find the entry marked with this code and expand it: the expanded row shows the plain-language reason and the context captured at the moment of failure. For a store request, that context may include the server’s own error code (serverCode), the HTTP status or the endpoint; the fields shown depend on where the failure occurred. When reporting a problem, use Copy debug info at the top of the Logs screen (Share debug info on phones and tablets) rather than screenshots: it bundles the app version, connection state and the most recent errors. Logs are kept for at most 30 days, so collect them while the problem is fresh. Also copy any browser-console error that appeared before the POS was able to write its own log entry.
Details
- Code:
HOST141(SEARCH_BLOCKED_BY_WAF) - Severity: warn
- Introduced in: WCPOS 1.10.0