# Error with code blocks: 403 Forbidden

**URL:** https://meta.discourse.org/t/error-with-code-blocks-403-forbidden/280764
**Category:** Support
**Created:** [October 2, 2023, 4:12pm UTC](https://meta.discourse.org/t/error-with-code-blocks-403-forbidden/280764 "2023-10-02T16:12:13Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [October 2, 2023, 5:09pm UTC](https://meta.discourse.org/t/error-with-code-blocks-403-forbidden/280764/3 "2023-10-02T17:09:02Z")

</div>

> [@nat](#):
>
> Could I suggest you check with [your moderator](https://hpc-discourse.uni.lu/t/about-the-knowledge-nuggets-category/37) to see if such restrictions are in place?

Further to this, we nearly _always_ find that 403 errors like this when attempting to create posts (especially with code blocks!) are due to an overzealous [WAF](https://en.wikipedia.org/wiki/Web_application_firewall) believing the code blocks are shellcode or an injection attack.

I note that the instance in question seems to be fronted by a WAF:

```plaintext
○ → host hpc-discourse.uni.lu
hpc-discourse.uni.lu is an alias for fstc-waf2.uni.lu.

```

and thus I strongly suspect the 403 errors are coming not from Discourse, but from your WAF.

Inspecting the headers of the errors in the browser should be able to tell you the source of the rejection.

---

_[View the full topic](https://meta.discourse.org/t/error-with-code-blocks-403-forbidden/280764)._