Redirected to InfinityFree 403 Forbidden page

While working on your website, you may be redirected to the InfinityFree 403 error page. This article explains why this can happen, and what you can do to solve it.

The URL contains a blocked file or folder name

The “chat” keyword

Live chat scripts are not allowed on InfinityFree hosting. Chat scripts work by constantly refreshing the page in the background. These background refreshes generates excessive server load, which is why we cannot host them. You are free to use live chat on your website though, but you will have to use an externally hosted chat system to handle the messages.

To enforce this, the chat keyword is blocked on our servers. If you try to access any URL with chat in it, you’ll get a 403 Forbidden page. For example, http://example.com/chat.php, http://example.com/livechat/index.php will all result in a 403 error.

To fix this, you can rename the file or folder to anything else (like talk, message, conversation or whatever else you want).

Please do note that live chat scripts are banned completely, and being able to work around this block doesn’t mean it’s OK to host a live chat script with us.

The includes folder

For security reasons, all files in a folder includes are blocked. This includes URLs like http://example.com/includes/function.php or http://example.com/includes/pages/product.php.

The idea behind this is that includes means that the folder contains scripts meant to be loaded into other scripts with PHP include (or require). Scripts like that are generally not meant to be accessed directly.

The fix for this is simple: do not use the folder name includes for anything that’s supposed to be accessed by browser. Instead, put such pages in a folder pages, functions, actions or a folder with any other name.

Your site blocks access from your IP address

With .htaccess rules, it’s possible to selectively block or allow visitors based on their IP address. But using these rules, it’s also possible to lock yourself out of your site.

To do so, open a file manager or FTP connection to your site, go to the website folder and open the file .htaccess.

If there are lines starting with deny from or allow from in the file, it means IP access control is configured on your site.

If you do not want to do any IP level restriction, you can simply remove all these lines from your file.

If there is a line allow from all, you should look for any lines with deny from .... that contain your IP address.

If there is a line deny from all, then you should add a line with allow from .... that contains your IP address.

3 Likes

I should ask to clarify, and I hope that other people have this question as well to prevent my question from being self-centered:

Why do you block folders containing the words include/require? Is this for the safety regarding people who do not understand this principle well (the principle of include/require), preventing them from accidentally harming their website?

Or is there another reason behind blocking these folders that might otherwise cause problems to people or their website (or Infinityfree)?

2 Likes

Good question, but one I omitted for a reason.

The reason is that I didn’t block these URLs, but iFastNet did. And I don’t know for sure when or why they did this.

My guess, based on my experience with iFastNet and how they approach things, is that there was a security problem in some popular script or CMS which placed some shared code in the includes folder, which had security problems if these scripts were accessed directly. Like exposing sensitive data, or be used for spam. And to prevent this from being abused, the decision was made to block access to the files and folders that enabled these attacks.

But I didn’t include it in the article because it’s completely unverified.

4 Likes