Error map
403 Forbidden wp-admin WordPress: 403 Forbidden on wp-admin, wp-login.php or admin-ajax.php
WordPress · layer 4, Application & API
Centre: this error. First ring: errors it is linked with (12). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (12)
HTTP 403 Forbidden
The server understood the request but refuses to authorize it — you (or the server process) are not allowed to access this resour…
FastCGI sent in stderr: "Primary script unknown"
Nginx passed a script path to PHP-FPM that PHP-FPM couldn’t find — usually a wrong SCRIPT_FILENAME or root.
Cloudflare Error 1015: You are being rate limited
The site’s Cloudflare rate-limiting rule blocked you for sending too many requests in a short time.
Cloudflare Error 1005: Access denied — The owner of this website has banned the autonomous system number (ASN) your IP address is in
The site owner blocked your network provider (ASN) — common for VPNs, cloud/data-center IPs and some mobile carriers.
Cloudflare Error 1006 / 1007 / 1008: Access denied — Your IP address has been banned
The site owner (or a Cloudflare security setting) blocked your IP address.
Cloudflare Error 1010: The owner of this website has banned your access based on your browser's signature
Cloudflare’s bot detection blocked the request because its browser fingerprint looks automated.
Cloudflare Error 1020: Access Denied
A Cloudflare firewall/WAF custom rule blocked the request — the visitor’s IP, country, user agent or request pattern matched a bl…
WordPress: This block contains unexpected or invalid content. Attempt Block Recovery
The saved HTML of a block doesn’t match what the block’s current save function produces — after a plugin update, manual HTML edit…
Contact Form 7: There was an error trying to send your message. Please try again later.
The form submitted, but wp_mail() failed to send — the server can’t send mail or the mail settings are wrong.
Cloudflare "Just a moment..." / "Checking your browser" challenge loop (Verify you are human never finishes)
The Cloudflare challenge keeps reloading — the browser can’t pass it because cookies/JavaScript are blocked, the clock is wrong,…
API/app requests get 403 with cf-mitigated: challenge (Bot Fight Mode / challenge on non-browser clients)
Cloudflare is answering API calls, webhooks or mobile-app requests with a challenge page (HTML 403) because bot protection treats…
WordPress: Sorry, you are not allowed to upload this file type / Sorry, this file type is not permitted for security reasons
WordPress blocked the upload because the file extension/MIME type isn’t in its allowed list (SVG, JSON, WEBP on old versions, fon…
Two steps away (36)
Git: Permission denied (publickey). fatal: Could not read from remote repository.
SSH authentication to GitHub/GitLab/Bitbucket failed — no key, wrong key, or the key isn’t added to your account.
AWS S3: AccessDenied (403) when calling GetObject / PutObject
An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 request.
Linux: Permission denied
Your user (or the service user) lacks read/write/execute permission on a file, directory or one of its parents.
HTTP 404 Not Found
The server can’t find anything at the requested URL.
HTTP 502 Bad Gateway
A proxy or gateway (Nginx, load balancer, CDN) got an invalid response — or no response — from the upstream server behind it.
PHP Fatal error: Allowed memory size of X bytes exhausted
The script tried to use more memory than PHP’s `memory_limit` allows.
AWS: ThrottlingException / Rate exceeded
You exceeded the request rate for an AWS API; retry with exponential backoff.
HTTP 429 Too Many Requests
You’ve hit a rate limit — too many requests in a given time window. Slow down and retry later.
API Error: Too many concurrent requests (concurrency limit reached)
You have more requests in flight at once than the API allows for your key — even if your requests-per-minute rate is fine.
Webhook signature verification failed (Stripe, Razorpay, GitHub…)
Your endpoint computed a different HMAC signature than the one the provider sent, so the webhook is rejected.
driver failed programming external connectivity on endpoint: iptables: No chain/target/match by that name
Docker’s iptables rules were wiped (firewalld/ufw reload, iptables flush) while Docker was running, so it can’t publish ports.
Error creating: pods is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false ...
The namespace enforces a Pod Security Standard (baseline/restricted) and the pod spec breaks one of its rules.
ssh: connect to host x port 22: Connection timed out
SSH packets get no reply — a firewall/security group drops them, the server is off, or the IP is wrong.
WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! (ssh host key changed)
The server’s SSH host key differs from the one saved in ~/.ssh/known_hosts — usually because the server was rebuilt or the IP was…
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY
apt can’t verify a repository’s signature because the repo’s signing key isn’t installed (or has expired/rotated).
HTTP 418 I'm a teapot
An April Fools’ status from RFC 2324 — some sites and WAFs return it on purpose to tell bots or scrapers to go away.
Nginx 444 No Response (connection closed without response)
An Nginx-specific code: the server deliberately closed the connection without sending anything — a rule is dropping the request.
Cloudflare Error 1009: Access denied — The owner of this website has banned the country or region your IP address is in
The site blocks visitors from your country/region.
Cloudflare Error 520: Web Server Returned an Unknown Error
Cloudflare connected to your origin, but the origin returned an empty, unknown or invalid response.
HTTP 451 Unavailable For Legal Reasons
The content is blocked for legal reasons — a court order, government censorship, sanctions, or GDPR geo-blocking.
connect: No route to host (EHOSTUNREACH)
The destination host isn’t reachable — it’s down, on another subnet without routing, or a firewall rejects with “host unreachable…
WordPress: Updating failed. The response is not a valid JSON response.
The block editor saved via the REST API but got HTML or an error page back — broken permalinks, a security plugin/WAF, or PHP out…
WordPress: 404 Not Found on every page except the homepage (permalinks / .htaccess / Nginx rules)
Pretty permalinks aren’t being routed to index.php — .htaccess is missing/ignored (Apache) or Nginx lacks try_files.
WordPress: Are you sure you want to do this? Please try again. (nonce check failed)
A WordPress security nonce didn’t validate — the page was open too long, cached, or a plugin/theme form is broken.
Warning: A component is changing an uncontrolled input to be controlled
An input’s `value` started as `undefined` (uncontrolled) and later became a defined value (controlled), or vice versa.
PHP mail() returns false / emails not delivered
PHP’s mail() function failed or emails never arrive (spam or rejected).
SES MessageRejected: Email address is not verified. The following identities failed the check in region
SES refused to send because the From address/domain isn’t verified — or the account is still in the SES sandbox, where recipients…
Cloudflare Error 1011: Access denied (Hotlinking denied)
An image or file is being loaded from another site, and Cloudflare Hotlink Protection blocked it.
Cloudflare Turnstile error 110200 / 300030 / 600010 (widget fails to load or verify)
The Turnstile widget couldn’t run or validate — wrong sitekey/domain, blocked scripts, or a client/network issue.
java.lang.SecurityException: Permission Denial ... requires android.permission.X
The app called an API that needs a permission it hasn’t declared or the user hasn’t granted at runtime.
SyntaxError: Unexpected token < in JSON at position 0
`JSON.parse()` / `response.json()` received something that isn’t JSON — very often an HTML error page.
ASP.NET Core: The antiforgery token could not be decrypted / The required antiforgery cookie is not present (400 Bad Request)
Form POST failed antiforgery validation — the token is missing, the cookie is missing, or Data Protection keys changed so old tok…
JWT error: invalid algorithm / The specified alg value is not allowed / jwt signature is required
The token’s alg header doesn’t match the algorithms the verifier allows — e.g. RS256 token verified as HS256, or an unsigned (alg…
WordPress: The link you followed has expired
Usually an upload (theme, plugin, media) larger than PHP’s upload/post limits — WordPress receives an empty request and shows thi…
NotAllowedError: play() failed because the user didn't interact with the document first.
The browser blocked media autoplay with sound until the user interacts with the page.
Upload error: File type not allowed / unsupported file type
The upload was rejected because the file’s type — extension, MIME type or actual content — isn’t on the allowed list.
Map another error
Popular: 4035004000xC000007BTypeErrorCritical error404NullPointerException