# Inserting Javascript yields 403 error
**URL:** https://meta.discourse.org/t/inserting-javascript-yields-403-error/154738
**Category:** Development
**Created:** [June 13, 2020, 9:42am UTC](https://meta.discourse.org/t/inserting-javascript-yields-403-error/154738 "2020-06-13T09:42:31Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Judith](https://meta.discourse.org/u/Judith)
#### Post date: [June 13, 2020, 9:42am UTC](https://meta.discourse.org/t/inserting-javascript-yields-403-error/154738/1 "2020-06-13T09:42:32Z")
According to previous posts in this forum, it should be possible to insert custom Javascript code into the or fields of the default theme, but whenever I try to do so, I get a popup saying “403 error”. Given that I am the admin but not a developer, how can I add my one line of custom Javascript?
---
### Author:  [@hawm](https://meta.discourse.org/u/hawm)
#### Post date: [June 13, 2020, 12:26pm UTC](https://meta.discourse.org/t/inserting-javascript-yields-403-error/154738/2 "2020-06-13T12:26:01Z")
You may have no permission to using the scripts resources by some [Referrer-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy), make sure it’s public access or others right permission.
---
### Author:  [@evert](https://meta.discourse.org/u/evert)
#### Post date: [July 25, 2022, 8:53am UTC](https://meta.discourse.org/t/inserting-javascript-yields-403-error/154738/3 "2022-07-25T08:53:22Z")
I’m experiencing the same problem. Did you manage to fix it, @Judith ?
Even a test with `` gives me a 403, so I’m not sure whether it’s a Referrer-Policy issue?
---
### Author:  [@Judith](https://meta.discourse.org/u/Judith)
#### Post date: [July 30, 2022, 9:05am UTC](https://meta.discourse.org/t/inserting-javascript-yields-403-error/154738/4 "2022-07-30T09:05:11Z")
Unfortunately not ☹
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [July 30, 2022, 9:52am UTC](https://meta.discourse.org/t/inserting-javascript-yields-403-error/154738/5 "2022-07-30T09:52:51Z")
Could you give us some more details about what you’re trying to add and where? That might rustle up a few more community responses?
---
### Author:  [@Judith](https://meta.discourse.org/u/Judith)
#### Post date: [August 16, 2022, 10:01am UTC](https://meta.discourse.org/t/inserting-javascript-yields-403-error/154738/6 "2022-08-16T10:01:52Z")
It fails at any level. I went to Default Theme \> Edit CSS/HTML \> Common \> Header and as an experiment I tried to add
```plaintext
```
and even that fails with a popup saying “403 error”, so I didn’t even try to do anything more fancy.
I have an installation on DigitalOcean exactly according to the textbook and updated to the latest version. Is it necessary to change anything about the standard installation in order to be able to use Javascript?
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [August 16, 2022, 10:50am UTC](https://meta.discourse.org/t/inserting-javascript-yields-403-error/154738/7 "2022-08-16T10:50:23Z")
> **Let's tuck this away as I don't think it's useful after all...**
>
> Could you try adding it as a custom theme component instead?
>
> Quick how-to:
>
> - Go to `/admin/customize/themes`
> - Click on **install** and then **create new**
> - Give it a name, and select ‘component’.
> - **Create**
> - Add it to your theme
> - Click on the **Edit CSS/HTML** button and make your changes there
>
> And save. 👍
>
> 
>
> * * *
>
> Though I’ve also tested it in my default theme header too, and that has worked. So there may be something unusual about your setup. Does it work when you try to trigger it in [safe mode](https://meta.discourse.org/t/53504?silent=true)?
Hang on, this sounds familiar. Do you have any browser extensions you can turn off? (or try in a private window) And is there more detail on the errors in the console?
---
### Author:  [@simonk](https://meta.discourse.org/u/simonk)
#### Post date: [August 16, 2022, 11:30am UTC](https://meta.discourse.org/t/inserting-javascript-yields-403-error/154738/8 "2022-08-16T11:30:36Z")
Do you have any kind of Web Application Firewall in front of Discourse (eg. CloudFlare or AWS WAF)? It might be detecting it as a Cross-Site Scripting attack.
---
### Author:  [@merefield](https://meta.discourse.org/u/merefield)
#### Post date: [August 16, 2022, 1:07pm UTC](https://meta.discourse.org/t/inserting-javascript-yields-403-error/154738/9 "2022-08-16T13:07:28Z")
> [@Judith](#):
>
> Default Theme \> Edit CSS/HTML \> Common \> Header
How about Head not Header?
---
### Author:  [@smileBeda](https://meta.discourse.org/u/smileBeda)
#### Post date: [March 22, 2023, 4:18am UTC](https://meta.discourse.org/t/inserting-javascript-yields-403-error/154738/10 "2023-03-22T04:18:15Z")
This error was not happening just a week ago on a test Discourse instance I have and is happening this week.
I tried all possible locations but to be honest, JS belongs just before the closing body tag not into the head, so that is where I would like it to go (and, that is what worked just last week)
It just pops up a `403 error` modal, that’s it.
I made sure this is not due to components or theme… but not sure if it is due to some setting I inadvertently changed?