# HOST141: Search blocked by waf

## What this means[​](#what-this-means "直接链接到 What this means")

The host's security filter is blocking product searches.

A firewall rule on this host rejects REST requests whose query string contains non-ASCII characters or SQL-looking words. Product names with accents, and searches containing words like 'select' or 'union', will fail with a 403 even though they are ordinary catalogue searches. The till works otherwise; searches will be unreliable until the rule is relaxed.

## What to do[​](#what-to-do "直接链接到 What to do")

Export diagnostics and contact support. Retry after making the change above; retrying without it will fail the same way.

## Your data[​](#your-data "直接链接到 Your data")

No order or product data is affected.

## Troubleshoot[​](#troubleshoot "直接链接到 Troubleshoot")

1. Ask the host to allow-list the store's own REST search parameters (/wcpos/ and /wc/ routes) in the query-string firewall rules.
2. On OWASP CRS-based firewalls, the SQL-injection rules on the 's' and 'search' arguments are the usual culprits — exclude those arguments for REST API routes.
3. Security plugins with a 'filter suspicious query strings' toggle need an exception for the REST API, not a global off switch.

## Where to look[​](#where-to-look "直接链接到 Where to look")

When WCPOS can save this error, it is recorded on the device that raised it. Open **Store health → Logs** (the heart-pulse icon at the bottom of the navigation drawer), find the entry marked with this code and expand it: the expanded row shows the plain-language reason and the context captured at the moment of failure. For a store request, that context may include the server’s own error code (`serverCode`), the HTTP `status` or the `endpoint`; the fields shown depend on where the failure occurred. When reporting a problem, use **Copy debug info** at the top of the Logs screen (**Share debug info** on phones and tablets) rather than screenshots: it bundles the app version, connection state and the most recent errors. Logs are kept for at most 30 days, so collect them while the problem is fresh. Also copy any browser-console error that appeared before the POS was able to write its own log entry.

## Details[​](#details "直接链接到 Details")

* **Code:** `HOST141` (`SEARCH_BLOCKED_BY_WAF`)
* **Severity:** warn
* **Introduced in:** WCPOS 1.10.0