# Whenever a post contains "substring" I get a 403 error

**URL:** <https://meta.discourse.org/t/whenever-a-post-contains-substring-i-get-a-403-error/202846>\
**Category:** Product Support\
**Created:** [September 7, 2021, 1:59pm UTC](https://meta.discourse.org/t/whenever-a-post-contains-substring-i-get-a-403-error/202846 "2021-09-07T13:59:17Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![Mr.X\_Mr.X](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mr.x_mr.x/32/126610_2.png) [@Mr.X\_Mr.X](https://meta.discourse.org/u/Mr.X_Mr.X)\
**Post date:** [February 2, 2022, 8:05pm UTC](https://meta.discourse.org/t/whenever-a-post-contains-substring-i-get-a-403-error/202846/4 "2022-02-02T20:05:58Z")

</div>

You might have a WAF enabled that blocks XSS attempts and substring is commonly used in the exploit syntax. If you’re using Cloudflare with WAF enabled that would be the cause.

---

_[View the full topic](https://meta.discourse.org/t/whenever-a-post-contains-substring-i-get-a-403-error/202846)._