We get a 403 error by Wordfence Security on a wordpress site while creating a Mailing using Mosaico.

On little investigation - I see the error is due to the addition of data-bind attribute in the HTML. For eg. if the template html is -

<p style="color: #aaaaaa; font: 14px/18px Frutiger, 'Frutiger Linotype', 'Helvetica Neue', Helvetica, Arial, sans-serif; ; margin: 0 0 10px 0; padding: 0; text-align: center;" data-bind="virtualAttrStyle: 'color: #AAAAAA; '+'font: '+('14px/18px '+$root.content().sansFace())+'; '+'margin: 0 0 10px 0; '+'padding: 0; '+'text-align: center;'+''">
  Don't want to receive any more email from us?
  <br />
  <a style="color: #e0e0e0;" 
    data-bind="virtualAttrStyle: 'color: #E0E0E0;'+''">
  </a> from our list.

The error in the console pops up not letting the template to be saved.

403 Forbidden

A potentially unsafe operation has been detected in your request to this site, and has been blocked by Wordfence.

If I remove the data-bind attribute from the anchor tag - the mailing is saved without any errors. Also, if the Wordfence plugin is disabled - the 403 error is not shown - but this might not be the solution.

Any thoughts on why this error might be arising and ways to fix it?

3 Answers 3


Wordfence uses knockout.js for data binding. I see Mosaico adds data-bind attribute to the HTML input which is considered prone to XSS attack by knockout and 403 error is shown by wordfence.

I've disabled XSS in the Wordfence setting and the mailing is working correctly for now. Happy to look for answer if there is a way to avoid XSS attack in mosaico template builder?


I also had a similar problem - I solved by whitelisting the specific url using Wordfences Live traffic view (Wordfence -> tools) to locate the blocked connection and then whitelist param from firewall.


I had a similar issue, but just using one of the standard sample mailing templates (not Mosaico). Disabling the XSS option in Wordfence also worked, although I'd like to keep the XSS check.

  • Just an update... I could never find the URL/param I needed to whitelist. Perhaps it's because I don't have the Wordfence Premium. Instead, I was able to turn on Learning Mode just long enough to execute a "save" in Mosaico and then return to Protected Mode. The URL/param was captured in the whitelist. Oct 7, 2019 at 18:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.