Skip to main content
Version: 1.x

HOST141: Search blocked by waf

What this means

The host's security filter is blocking product searches.

A firewall rule on this host rejects REST requests whose query string contains non-ASCII characters or SQL-looking words. Product names with accents, and searches containing words like 'select' or 'union', will fail with a 403 even though they are ordinary catalogue searches. The till works otherwise; searches will be unreliable until the rule is relaxed.

Your data

No order or product data is affected.

Troubleshoot

  1. Ask the host to allow-list the store's own REST search parameters (/wcpos/ and /wc/ routes) in the query-string firewall rules.
  2. On OWASP CRS-based firewalls, the SQL-injection rules on the 's' and 'search' arguments are the usual culprits — exclude those arguments for REST API routes.
  3. Security plugins with a 'filter suspicious query strings' toggle need an exception for the REST API, not a global off switch.

Details

Code
HOST141 (SEARCH_BLOCKED_BY_WAF)
Severity
warn
Introduced in
WCPOS 1.10.0