Theme making direct ajax calls to theme folder

server setting that most likely responsible for restricting public access to the php files :

  1. Permission (try to set chmod 774 for the php file)
  2. .htaccess (try to add rewrite rule for that php file)

maybe i’m wrong but it worth a try.