After upgrading to latest CiviCRM (5.66.0) on WordPress. We have been getting errors loading the system status page, and sometime getting the default "The is an issue with your Wordpress site", and enabling WordPress debugging shows nothing.

the site tries to load {url redacted}/wp-admin/admin.php?page=CiviCRM&q=civicrm%2Fajax%2Frest - but returns a 500 error. The file exists and is parsing, but it's throwing this JSON error string:

{"IP":"...","level":"security","referer":null,"reason":"CSRF suspected","is_error":1,"error_message":"SECURITY ALERT: Ajax requests can only be issued by javascript clients, eg. CRM.api3()."}

I expect this is because of the migration to civicrm/ajax/rest in 5.47, but I am unsure of how to correct the issue - is there a setting to be enabled or has anyone else had this issue and resolved it?

Any help or feedback is appreciated.

  • 1
    SECURITY ALERT: Ajax requests can only be issued by javascript clients isn't the real error message, that's just what you see when you click on the ajax link from the console and try to load it in a page (it won't let you do that). Instead, try clicking the error message itself in the console.
    – Coleman
    Commented Oct 24, 2023 at 23:48
  • Hi @Coleman - that is the error message I get when clicking the link in the console and loading the actual page: wp-admin/admin.php?page=CiviCRM&q=civicrm%2Fajax%2Frest Working my way through logs and on screen error reporting, I think that I have the issue resolved - by enabling the CiviContribute extension/module. Why this would matter is a bit confusing, but I agree that a detailed error message would have helped. My assumption is that there were portions of the Contribute module that were being called and failing, but no specific errors shown, so it looked like a AJAX failure. Commented Oct 25, 2023 at 18:26
  • "that is the error message I get when clicking the link in the console" - yes that's my point. You're not allowed to click the link in the console because it's an ajax request, so you get the security error denying you (a non-ajax client) from accessing the ajax-only url. But it's not actually relevant (you'd get the same result with any ajax request not just a failed one).
    – Coleman
    Commented Oct 25, 2023 at 18:47
  • Instead of following it as a link, you can go to the network tab of your console and click on it there for details about the response that came back from the server. Very interesting that it fails with CiviContribute disabled; that does sound like it could be a bug somewhere, it would be great to get more details from you about the error if you are able to find them.
    – Coleman
    Commented Oct 25, 2023 at 18:51


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.