When using the search option under the menu on the blog, we are receiving a request forbidden page. How can this be fixed?
This usually isn’t an issue directly with HubSpot but rather with your site’s security settings or server configuration. Most often, it’s caused by firewall rules, bot protection, or a recent plugin update blocking search requests.
What you can check:
- In HubSpot, go to Settings → Website → Blog and make sure there aren’t any restrictions or custom scripts interfering.
- If you’re using Cloudflare or other security services, ask your IT team to review the firewall or security rules, they might be blocking certain query patterns.
- If you recently installed or updated plugins or changed your theme code, try temporarily disabling them to see if the issue goes away.
None of what you mentioned worked, do you have any other suggestions?
The Chrome dev console indicates it’s some form of CORS issue. I’ll add it below. One question—are (blog.nexusglobal.com) and the root domain (www.nexusglobal.com) both hosting content on HubSpot? Or just the blog subdomain?
Google analysis from the console:
"Explanation
Understanding the problem
The console message POST Simplifying Maintenance Planning | Optimize Work Management… 403 (Forbidden) indicates that your website attempted to make a POST request to the URL Simplifying Maintenance Planning | Optimize Work Management but the server responded with a 403 Forbidden status code. This means the server understood the request but is refusing to fulfill it.
The 403 Forbidden status typically signifies that the client (your browser) does not have the necessary permissions or authorization to access the requested resource. This could be due to various reasons, such as:
Missing or invalid authentication/authorization: The request might require a valid user session, API key, or other credentials that were not provided or were incorrect.
IP address restriction: Access might be limited to specific IP addresses or ranges, and your current IP is not allowed.
Firewall or security rules: A web application firewall (WAF) or server-side security configuration might be blocking the request based on its characteristics (e.g., origin, headers, content).
Cross-Origin Resource Sharing (CORS) policy: Although the status is 403, a misconfigured CORS policy on the server could sometimes result in a forbidden response, especially if the Origin header is not allowed. In your case, the Origin is https://blog.nexusglobal.com, which is different from the request URL’s origin (https://www.nexusglobal.com).
…"
Thanks! — Jaycee