Why does check_ajax_referer give a 403 error on https websites?

that looks good in my eyes. but i just had the same issue, that’s why i stumbled over your question.

i fixed it in my case with

if (!wp_verify_nonce($_POST['nonce'], 'nonce')) {
    die(__('Security Check failed', 'textdomain'));
}

at the very beginning of my ajax action. no idea, where the 403 issue came from, since it worked on desktop machines, but not on my mobile. weird.. give it a shot and let me know, if this helps.

one other thing i saw in your code, but not sure, if it is causing issues: one time you use single quotes, the other time doubles. try to be consistent here.

wp_verify_nonce()

Related Posts:

  1. Nonces and Cache
  2. Is it safe to assume that a nonce may be validated more than once?
  3. Multiple ajax nonce requests
  4. AJAX requests broken due to HTTPS for wp-admin
  5. Nonces, AJAX, script variables & security in WordPress
  6. How do I check if AJAX nonces are implemented correctly?
  7. WP Admin AJAX Security – using POST to include a relative URL
  8. ajax nonce verification failing
  9. Using nonce when loading posts with AJAX
  10. Should wordpress nonce be placed in html form or in javascript file
  11. Ajax Security regarding user priviliges and nonces
  12. How to stop a nonce from being cached in an inline script, or alternatives to regenerate it if expired?
  13. How to get a unique nonce for each Ajax request?
  14. WordPress Ajax Data Security
  15. Nonces can be reused multiple times? Bug / Security issue?
  16. SSL breaks customizer: page isn’t returned from ajax
  17. Using Nonces for AJAX that only retrieves data
  18. How to verify nonce from Bulk/Quick Edit in save_post?
  19. How to add WordPress nonces to ajax request
  20. Security – Ajax and Nonce use [closed]
  21. Nonces and Ajax request to REST API and verification
  22. Ajax function returns -1
  23. Serving nonces through AJAX is not refreshing nonce, returning 403 error
  24. wp_verify_nonce always returns false when logged in as admin
  25. ajax and nonce when JavaScript is in a seperate file
  26. wp_verify_nonce doesn’t return true on server when it matches the nonce
  27. Why does WordPress Heartbeat login not refresh the nonces?
  28. wp-admin AJAX with Fetch API is done without user
  29. How to check an ajax nonce in PHP
  30. Can a wp_nonce created from domain 1 to be verified on domain 2?
  31. Is it safe to manually sign a user in using AJAX?
  32. how to send Ajax request in wordpress backend
  33. Identical wp_rest nonce returned from rest_api
  34. wp_create_nonce() in REST API makes user->ID zero
  35. SSO autologin WordPress + Ajax
  36. Should I check for privileges before hooking into `wp_ajax_$handle` or after?
  37. How can I set cookies on both secure and non-secure origins at the same time?
  38. Nonce fails on ajax save
  39. Images loading over http instead of https
  40. Is it secure to use admin-ajax.php in front?
  41. Unable to successfully verify nonce
  42. Cache plugins and ajax nonce verification
  43. Nonce doesn’t validate in nopriv call
  44. WordPress is creating nonce as a logged in user but verifying it incorrectly
  45. javascript ajax and nonce
  46. How to check nonce lifetime value of plugins?
  47. 200 return code on ‘POST /wp-admin/admin-ajax.php’ while NOT logged in
  48. Custom RPC end-point security best pratice?
  49. How to prevent my external API call from being called by anyone but me (my site)
  50. wp_verify_nonce not working on the mobile device
  51. How do I mitigate replay attacks when talking about actions that shouldn’t happen twice?
  52. check_ajax_reffer not working when logged
  53. How to safely pass post_id and user_id via AJAX to the backend (prevent user from changing it via JS)?
  54. AJAX form not working, still reloads on submit
  55. How to force the admin-ajax.php file to load over HTTPS?
  56. How to use nonces for frontend AJAX voting if the page gets cached?
  57. Can I make an ajax response cross-domain?
  58. WordPress wp_localize_script nonce and ajax URL
  59. How does the security of admin_ajax.php work?
  60. How to cache json with wp-super cache
  61. Can I use the same nonce for multiple requests on the same page?
  62. Is there a way to force ssl on certain pages
  63. Admin Notification after save_post, when ajax saving in gutenberg
  64. Cannot load admin-ajax.php. No access-control allow origin*
  65. Initialize JS with an ajax loaded ACF form
  66. WordPress Nonce Issue for Ajax Login and Logout
  67. How to modify wp_ajax function?
  68. Vue.js + AJAX Shortcode
  69. wp_ajax action is not running
  70. How do I set the url to make an ajax request for a html document?
  71. Populating content dynamically via AJAX and Advanced Custom Fields [closed]
  72. Create Page With wp_insert_post() and AJAX
  73. How to handle 400 status in Ajax [duplicate]
  74. How to process wordpress ajax call without action parameter?
  75. WordPress ajax works on FF but not on IE & chrome
  76. Are there any security risks when submitting data-attribute data through AJAX?
  77. Is it safe to use admin-ajax.php in the frontend?
  78. Why do Metabox use Nonces?
  79. WordPress action – Pass arguments into action in an AJAX call?
  80. Need help with ajax
  81. Get title and featured image using Ajax
  82. My function containing a mysql query launched by ajax is not working in wordpress. What am I missing?
  83. https rewrite not working for All in one security Brute force > rename login url
  84. Wp admin ajax load more
  85. wordpress ajax search posts
  86. How to inject data content from external json into a modal, using UIkit?
  87. Ajax by worpdress affects called jquery inside template file
  88. Having a self updating list
  89. First time doing Ajax with WP, how to do it?
  90. Unexpected WordPress search results
  91. WordPress Get Header and Footer using in Admin Area
  92. ajax page template
  93. Using Javascript Callback from plugin in a theme
  94. Why does my Ajax Get request give a 400 bad request?
  95. AJAX loading with custom parameters
  96. Adding custom fields to Wired Impact Volunteer Management Plugin
  97. Placing ajax actions in different class
  98. How to update my jquery/PHP function to add/remove user as favorites in (WordPress) users list
  99. randomly get 400 error while user is logged in wp_ajax
  100. register_rest_route to send via ajax as guest results to 403