403 on .well-known page

[cclambie]

I am repeating this 403 error here, from wordpress.org support - https://wordpress.org/support/topic/webfinger-plugin-does-not-work/

I just worked with the dev’s at WPMU to test it out. We tested with the ActivityPub plugin, without it. With security plugins, without them. With XML on/off. Changing pretty print permalinks from one to another. Adding .well-known directory in file system.

All same result of “403 – Forbidden access”

Troubleshooting Steps:

• Check your server error logs for more details.
  no 403 errors
• Temporarily disable other plugins to check for conflicts.
  Done
• Verify PHP has enough memory allocated (at least 128MB recommended).
  has 256MB
• Contact your hosting provider if the issue persists.
  Checked.

Result from your page:

https://webfinger.net/lookup/?resource=https%3A%2F%2Fdeliberativesuper.com.au%2Fauthor%2Ftempdev-2%2F
Request Log
02:36:05 Looking up WebFinger data for https://deliberativesuper.com.au/author/tempdev-2/
02:36:05 GET https://deliberativesuper.com.au/.well-known/webfinger?resource=https%3A%2F%2Fdeliberativesuper.com.au%2Fauthor%2Ftempdev-2%2F
02:36:06 Error getting JRD: 403 Forbidden

some of the access access log

2400:3740:210:8800:86c:354d:bfea:6935 - - [25/Mar/2026:02:57:34 +0000] "GET /.well-known/webfinger/?resource=acct:test@example.com HTTP/2.0" 403 790 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:147.0) Gecko/20100101 Firefox/147.0" "-" [0.000] "-" "-" "deliberativesuper.com.au"
2400:3740:210:8800:86c:354d:bfea:6935 - - [25/Mar/2026:02:57:33 +0000] "GET /.well-known/webfinger/?resource=acct:test@example.com HTTP/3.0" 403 793 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:147.0) Gecko/20100101 Firefox/147.0" "-" [0.000] "-" "-" "deliberativesuper.com.au"

wp info

wp-core

version: 6.9.4
site_language: en_AU
user_language: en_AU
timezone: Australia/Melbourne
permalink: /%postname%/
https_status: true
multisite: false
user_registration: 0
blog_public: 1
default_comment_status: open
environment_type: production
user_count: 1
dotorg_communication: true

wp-paths-sizes

wordpress_path: /var/web/site/public_html
wordpress_size: 63.44 MB (66522098 bytes)
uploads_path: /var/web/site/public_html/wp-content/uploads
uploads_size: 19.63 MB (20581047 bytes)
themes_path: /var/web/site/public_html/wp-content/themes
themes_size: 23.61 MB (24759348 bytes)
plugins_path: /var/web/site/public_html/wp-content/plugins
plugins_size: 189.67 MB (198883835 bytes)
fonts_path: /var/web/site/public_html/wp-content/uploads/fonts
fonts_size: directory not found
database_size: 6.67 MB (6995968 bytes)
total_size: 303.02 MB (317742296 bytes)

wp-dropins (1)

object-cache.php: true

wp-active-theme

name: Astra (astra)
version: 4.12.6
author: Brainstorm Force
author_website: https://wpastra.com/about/?utm_source=theme_preview&utm_medium=author_link&utm_campaign=astra_theme
parent_theme: none
theme_features: core-block-patterns, astra_hooks, widgets-block-editor, align-wide, automatic-feed-links, title-tag, post-thumbnails, starter-content, html5, post-formats, custom-logo, customize-selective-refresh-widgets, editor-style, responsive-embeds, woocommerce, rank-math-breadcrumbs, amp, widgets, menus
theme_path: /var/web/site/public_html/wp-content/themes/astra
auto_update: Disabled

wp-mu-plugins (1)

Hosting: author: (undefined), version: 1.0

wp-plugins-active (4)

WebFinger: version: 4.0.1, author: Matthias Pfefferle, Auto-updates disabled
WPMU DEV Dashboard: version: 4.11.30, author: WPMU DEV, Auto-updates disabled

wp-plugins-inactive (12)

ActivityPub: version: 8.0.2, author: Matthias Pfefferle & Automattic, Auto-updates disabled
Akismet Anti-spam: Spam Protection: version: 5.6, author: Automattic - Anti-spam Team, Auto-updates disabled
Defender: version: 5.10.0, author: WPMU DEV, Auto-updates disabled
Defender Pro: version: 5.10.0, author: WPMU DEV, Auto-updates disabled
Elementor: version: 3.35.8, author: Elementor.com, Auto-updates disabled
Forminator Pro: version: 1.52.0, author: WPMU DEV, Auto-updates disabled
Hummingbird Pro: version: 3.19.0, author: WPMU DEV, Auto-updates disabled
Jetpack: version: 15.6, author: Automattic, Auto-updates disabled
SmartCrawl Pro: version: 3.15.0, author: WPMU DEV, Auto-updates disabled
Smush Pro: version: 3.23.4, author: WPMU DEV, Auto-updates disabled
Solid Security Basic: version: 9.4.6, author: SolidWP, Auto-updates disabled
Two Factor: version: 0.15.0, author: WordPress.org Contributors, Auto-updates disabled
WPCode Lite: version: 2.3.5, author: WPCode, Auto-updates disabled
WP Mail SMTP: version: 4.7.1, author: WP Mail SMTP, Auto-updates disabled

wp-media

image_editor: WP_Image_Editor_Imagick
imagick_module_version: 1691
imagemagick_version: ImageMagick 6.9.11-60 Q16 x86_64 2021-01-25 https://imagemagick.org
imagick_version: 3.8.1
file_uploads: 1
post_max_size: 128M
upload_max_filesize: 128M
max_effective_size: 128 MB
max_file_uploads: 20
imagick_limits:
imagick::RESOURCETYPE_AREA: 122 MB
imagick::RESOURCETYPE_DISK: 1073741824
imagick::RESOURCETYPE_FILE: 768
imagick::RESOURCETYPE_MAP: 512 MB
imagick::RESOURCETYPE_MEMORY: 256 MB
imagick::RESOURCETYPE_THREAD: 1
imagick::RESOURCETYPE_TIME: 9.2233720368548E+18
imagemagick_file_formats: 3FR, 3G2, 3GP, AAI, AI, APNG, ART, ARW, AVI, AVIF, AVS, BGR, BGRA, BGRO, BIE, BMP, BMP2, BMP3, BRF, CAL, CALS, CANVAS, CAPTION, CIN, CIP, CLIP, CMYK, CMYKA, CR2, CR3, CRW, CUR, CUT, DATA, DCM, DCR, DCX, DDS, DFONT, DJVU, DNG, DOT, DPX, DXT1, DXT5, EPDF, EPI, EPS, EPS2, EPS3, EPSF, EPSI, EPT, EPT2, EPT3, ERF, EXR, FAX, FILE, FITS, FRACTAL, FTP, FTS, G3, G4, GIF, GIF87, GRADIENT, GRAY, GRAYA, GROUP4, GV, H, HALD, HDR, HEIC, HISTOGRAM, HRZ, HTM, HTML, HTTP, HTTPS, ICB, ICO, ICON, IIQ, INFO, INLINE, IPL, ISOBRL, ISOBRL6, J2C, J2K, JBG, JBIG, JNG, JNX, JP2, JPC, JPE, JPEG, JPG, JPM, JPS, JPT, JSON, K25, KDC, LABEL, M2V, M4V, MAC, MAGICK, MAP, MASK, MAT, MATTE, MEF, MIFF, MKV, MNG, MONO, MOV, MP4, MPC, MPG, MRW, MSL, MSVG, MTV, MVG, NEF, NRW, NULL, ORF, OTB, OTF, PAL, PALM, PAM, PANGO, PATTERN, PBM, PCD, PCDS, PCL, PCT, PCX, PDB, PDF, PDFA, PEF, PES, PFA, PFB, PFM, PGM, PGX, PICON, PICT, PIX, PJPEG, PLASMA, PNG, PNG00, PNG24, PNG32, PNG48, PNG64, PNG8, PNM, POCKETMOD, PPM, PREVIEW, PS, PS2, PS3, PSB, PSD, PTIF, PWP, RADIAL-GRADIENT, RAF, RAS, RAW, RGB, RGBA, RGBO, RGF, RLA, RLE, RMF, RW2, SCR, SCT, SFW, SGI, SHTML, SIX, SIXEL, SPARSE-COLOR, SR2, SRF, STEGANO, SUN, SVG, SVGZ, TEXT, TGA, THUMBNAIL, TIFF, TIFF64, TILE, TIM, TTC, TTF, TXT, UBRL, UBRL6, UIL, UYVY, VDA, VICAR, VID, VIDEO, VIFF, VIPS, VST, WBMP, WEBM, WEBP, WMF, WMV, WMZ, WPG, X, X3F, XBM, XC, XCF, XPM, XPS, XV, XWD, YCbCr, YCbCrA, YUV
image_format_transforms: image/heic → image/jpeg, image/heif → image/jpeg, image/heic-sequence → image/jpeg, image/heif-sequence → image/jpeg
gd_version: 2.3.3
gd_formats: GIF, JPEG, PNG, WebP, BMP, AVIF, XPM
ghostscript_version: unknown

wp-server

server_architecture: Linux 5.15.0-173-generic x86_64
httpd_software: nginx/1.26.1
php_version: 8.4.18 64bit
php_sapi: fpm-fcgi
max_input_variables: 3000
time_limit: 300
memory_limit: 256M
max_input_time: 180
upload_max_filesize: 128M
php_post_max_size: 128M
curl_version: 7.81.0 OpenSSL/3.0.2
suhosin: false
imagick_availability: true
pretty_permalinks: true
static_robotstxt_file: false
current: 2026-03-25T02:51:01+00:00
utc-time: Wednesday, 25-Mar-26 02:51:01 UTC
server-time: 2026-03-25T13:50:59+11:00

wp-database

extension: mysqli
server_version: 10.6.23-MariaDB-0ubuntu0.22.04.1
client_version: mysqlnd 8.4.18
max_allowed_packet: 134217728
max_connections: 50

wp-constants

WP_HOME: undefined
WP_SITEURL: undefined
WP_CONTENT_DIR: /var/web/site/public_html/wp-content
WP_PLUGIN_DIR: /var/web/site/public_html/wp-content/plugins
WP_MEMORY_LIMIT: 256M
WP_MAX_MEMORY_LIMIT: 256M
WP_DEBUG: false
WP_DEBUG_DISPLAY: true
WP_DEBUG_LOG: false
SCRIPT_DEBUG: false
WP_CACHE: false
CONCATENATE_SCRIPTS: undefined
COMPRESS_SCRIPTS: undefined
COMPRESS_CSS: undefined
WP_ENVIRONMENT_TYPE: production
WP_DEVELOPMENT_MODE: undefined
DB_CHARSET: utf8mb4
DB_COLLATE: undefined

wp-filesystem

wordpress: writable
wp-content: writable
uploads: writable
plugins: writable
themes: writable
fonts: does not exist
mu-plugins: writable

wp_mail_smtp

version: 4.7.1
license_key_type: lite
debug: No debug notices found.
lite_install_date: Mar 25, 2026 @ 12:00pm

[pfefferle]

Hey @cclambie 👋

this sound like WPMUDev is blocking the .well-known path completely in their Webserver config. Do they use well-known for their letsencrypt setup and block it for security reasons?

The error page is mentioning a possible problem in the WAF (Web Application Firewall) settings, so I would assume that there is a rule blocking it!?

[cclambie]

Thanks. I did talk to their support, and did a bunch of test with them.
I have asked them.
I also disabled their WAF settings completely, so no rules blocking that.

[pfefferle]

Is it still off? Because I can still see the WAF error!?!

[cclambie]

Yes it is

…

On Fri, 27 Mar 2026, 5:54 pm Matthias Pfefferle, ***@***.***> wrote: *pfefferle* left a comment (pfefferle/wordpress-webfinger#53) <#53 (comment)> Is it still off? Because I can still see the WAF error!?! — Reply to this email directly, view it on GitHub <#53?email_source=notifications&email_token=AAGWKYPNS4GKF6N5KOSOBML4SYQRLA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTIMJUGA2TQOBRGYYKM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-4140588160>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAGWKYPMJUV6ILUQ72EEZDD4SYQRLAVCNFSM6AAAAACW6IFFKSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DCNBQGU4DQMJWGA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[pfefferle]

I am sorry, that I am not very helpful here, but because the request is blocked even before it hits WordPress, it is quite hard to tell what goes wrong 😔

[cclambie]

So the WPMUDev team created a special Nginx rule that is now delivering the json output for webfinger.
https://deliberativesuper.com.au/wp-json/activitypub/1.0/webfinger?resource=acct:@deliberativesuper.com.au

The Activity Pub plugin is still showing an webfinger error, but this plugin is not showing an error.
So I posted over on the #activitypub plugin issue 3121