I have a pretty old site which I've just recently upgraded to 2.11.6. Everything works well, except that I can't update templates (in the CP) if they contain <script>, <meta>, <link>, or <style> tags. If I try, I get the error

403 Forbidden

A potentially unsafe operation has been detected in your request to this site.

Has anyone seen anything like this, or have an idea where I might check to solve this?

Edit/Additional information: While looking into Derek's suggestion about mod_security, I remembered that I had set this site to use PHP7 as a test, and sure enough, when I set it back to 5.6, I can update templates fine. So it's something to do with PHP7, but not sure what yet.

  • Are the templates of the type "Web Page" or something else?
    – AllInOne
    Feb 24 '17 at 15:48
  • Templates are set to Web Page Feb 25 '17 at 0:35

That has all of the earmarks of a mod_security filter preventing the request from even hitting ExpressionEngine. In your server logs (ask your host if you don't have access), you can probably confirm. We recommend that the control panel be whitelisted from mod_security, since admins will regularly submit content that includes HTML, JS, and other keywords that are commonly filtered for front-end security.

See this Stack Overflow topic for options on disabling via .htaccess, though it would be best for the host to set this exclusion for your ExpressionEngine admin.php file.


I apologize, this issue was unrelated to EE. WordPress was running on the same server, and in WordPress, a security plugin called WordFence was blocking the template saves when they contained suspect tags. I don't know why this only happened in PHP7, but disabling the security plugin fixed the issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.