HOST141: Search blocked by waf
What this means
The host's security filter is blocking product searches.
A firewall rule on this host rejects REST requests whose query string contains non-ASCII characters or SQL-looking words. Product names with accents, and searches containing words like 'select' or 'union', will fail with a 403 even though they are ordinary catalogue searches. The till works otherwise; searches will be unreliable until the rule is relaxed.
Your data
No order or product data is affected.
Troubleshoot
- Ask the host to allow-list the store's own REST search parameters (/wcpos/ and /wc/ routes) in the query-string firewall rules.
- On OWASP CRS-based firewalls, the SQL-injection rules on the 's' and 'search' arguments are the usual culprits — exclude those arguments for REST API routes.
- Security plugins with a 'filter suspicious query strings' toggle need an exception for the REST API, not a global off switch.