You might have a WAF enabled that blocks XSS attempts and substring is commonly used in the exploit syntax. If you’re using Cloudflare with WAF enabled that would be the cause.
Related topics
| Topic | Replies | Views | Activity | |
|---|---|---|---|---|
| Discourse Subscriptions (Core) - Server Error while trying to load /s/admin/products | 8 | 375 | July 26, 2025 | |
| "Show Full Post" button doesn't work in subfolder installations | 33 | 1461 | January 2, 2026 | |
| JavaScript embed won’t display embed, console log shows: Failed to execute postMessage on DOMWindow… | 19 | 6160 | April 26, 2022 | |
| Embedding Discourse Comments via Javascript over https | 2 | 781 | January 31, 2020 | |
| Embedding error | 13 | 4324 | November 21, 2020 |