# HOST141: Search blocked by waf

## What this means[​](#what-this-means "Enlace directo a What this means")

The host's security filter is blocking product searches.

A firewall rule on this host rejects REST requests whose query string contains non-ASCII characters or SQL-looking words. Product names with accents, and searches containing words like 'select' or 'union', will fail with a 403 even though they are ordinary catalogue searches. The till works otherwise; searches will be unreliable until the rule is relaxed.

## What to do[​](#what-to-do "Enlace directo a What to do")

Export diagnostics and contact support. Retry after making the change above; retrying without it will fail the same way.

## Your data[​](#your-data "Enlace directo a Your data")

No order or product data is affected.

## Troubleshoot[​](#troubleshoot "Enlace directo a Troubleshoot")

1. Ask the host to allow-list the store's own REST search parameters (/wcpos/ and /wc/ routes) in the query-string firewall rules.
2. On OWASP CRS-based firewalls, the SQL-injection rules on the 's' and 'search' arguments are the usual culprits — exclude those arguments for REST API routes.
3. Security plugins with a 'filter suspicious query strings' toggle need an exception for the REST API, not a global off switch.

## Where to look[​](#where-to-look "Enlace directo a Where to look")

When WCPOS can save this error, it is recorded on the device that raised it. Open **Store health → Logs** (the heart-pulse icon at the bottom of the navigation drawer), find the entry marked with this code and expand it: the expanded row shows the plain-language reason and the context captured at the moment of failure. For a store request, that context may include the server’s own error code (`serverCode`), the HTTP `status` or the `endpoint`; the fields shown depend on where the failure occurred. When reporting a problem, use **Copy debug info** at the top of the Logs screen (**Share debug info** on phones and tablets) rather than screenshots: it bundles the app version, connection state and the most recent errors. Logs are kept for at most 30 days, so collect them while the problem is fresh. Also copy any browser-console error that appeared before the POS was able to write its own log entry.

## Details[​](#details "Enlace directo a Details")

* **Code:** `HOST141` (`SEARCH_BLOCKED_BY_WAF`)
* **Severity:** warn
* **Introduced in:** WCPOS 1.10.0