When a CMS saves ordinary text but returns HTTP 403 as soon as a <script> block is added, the request may be blocked before the CMS handles it. Confirm the failing POST request and the web application firewall rule instead of weakening global security settings.
Last updated: October 12, 2026.
<?php
use Joomla\CMS\Factory;
$document = Factory::getApplication()->getDocument();
$assets = $document->getWebAssetManager();
$assets->registerAndUseScript(
'site.floating-button',
'site/floating-button.js',
[],
['defer' => true],
['core']
);For a maintained Joomla extension or template, place the JavaScript in its media assets and register it through the Web Asset Manager. Adjust the asset name and URI to the extension’s real structure. This avoids storing executable code inside an administrator content field.
Identify where the 403 originates
Open browser developer tools, reproduce the save, and inspect the request URL, response status, and response headers. Then correlate the timestamp with the web server and ModSecurity audit logs. A WAF event should identify the matched rule ID, request field, and matched fragment. A CMS authorization or CSRF failure instead requires checking the session, token, permissions, and extension logs.
Joomla’s official Web Asset Manager documentation describes registering and using script files or named inline assets. Keeping behavior in a template or extension also makes deployment, dependencies, caching, and review more predictable.
Tune the smallest possible WAF scope
If a legitimate administrator request triggers a false positive, ask the hosting provider to review that exact audit event. The OWASP Core Rule Set false-positive tuning guide recommends rule exclusions rather than modifying vendor rules. Scope an exclusion to the known rule, route, and request parameter whenever possible.
Do not disable ModSecurity site-wide or allow arbitrary scripts from untrusted editors. Re-test the original request and a representative malicious payload after any rule change. Continue with tracing JavaScript errors, protecting forms with Turnstile, and building a secure upload pipeline.
