Persistent 403 Error on Menu Settings – Likely Blocked by Server-Level Security (ModSecurity)

Message:

Dear Fluent Community team,

I'm currently encountering a persistent 403 Forbidden error when attempting to save or update the menu settings via the Fluent Community Pro admin interface. The error is triggered by a POST request to:

bash

KopierenBearbeiten

/wp-json/fluent-community/v2/settings/menu-settings

Browser console output:

plaintext

KopierenBearbeiten

POST https://mydomain.com/wp-json/fluent-community/v2/settings/menu-settings 403 (Forbidden)

JS console log:

javascript

KopierenBearbeiten

Your server firewall blocked the request or it's a plugin conflict. {status: 403, responseText: "Forbidden\n"}

After extensive testing, I can confidently rule out:

• WordPress user role/capability issues (the endpoint itself does not enforce current_user_can()).
• Local plugin or theme conflicts.
• Fluent configuration or nonce issues.
• .htaccess ModSecurity override (SecFilterEngine Off) – tested without effect.

Likely Cause:
This issue appears to be triggered by ModSecurity or server-level WAF rules on shared/cloud hosting platforms (in this case: Hostinger). Since POST requests to custom REST API routes with structured JSON payloads are often scrutinized by ModSecurity, it’s plausible the payload for /menu-settings contains patterns that trip these rules.

Unfortunately, Hostinger does not allow custom ModSecurity whitelisting for shared hosting users. Even with .htaccess directives, the request is blocked before WordPress can process it.

Request:
Would it be possible to:

1. Review the structure and headers of the POST /menu-settings endpoint and see if the payload can be made more ModSecurity-friendly?
2. Alternatively, add a fallback method to update the menu via admin-ajax.php or a local, nonce-protected form submission (less likely to be blocked).
3. Document the API endpoint requirements and potential server firewall implications in the Fluent Community technical docs.

This issue has already been raised by multiple users in the community and could be a significant usability roadblock—especially for users on budget-friendly hosting environments without full firewall control.

Thank you for your excellent work on Fluent Community. Looking forward to your thoughts and a possible workaround or roadmap adjustment.

Best regards Mike