UltraCart HTTP 403 Error Troubleshooting Guide
Introduction
This guide summarizes common HTTP 403 (Forbidden) errors in UltraCart environments, including:
-
StoreFront / Checkout customer issues
-
Merchant Portal access issues
-
API and integration errors
-
Firewall / WAF (Web Application Firewall) blocks, including AI automation tools
An HTTP 403 occurs when a server understands the request but refuses to authorize it.
Note:
This guide distinguishes between application-level 403 errors and firewall/WAF blocks. Proper classification is critical for fast troubleshooting.
Quick-Reference Troubleshooting Matrices
Customer-Facing 403 Matrix (StoreFront / Checkout)
[Image Placeholder: Checkout session timeout / access denied example]
| Symptom / Error Message | Most Likely Cause | Immediate Customer Fix | Merchant Prevention / Fix |
|---|---|---|---|
| “This site can’t be reached” during custom domain setup | DNS/SSL mismatch | Use temporary ultrastore domain | Complete SSL setup and allow propagation |
| “Access Denied” mid-checkout | Checkout session timeout | Refresh and restart checkout | Add session timeout UX guidance |
| “HTTP/1.1 403 - Your customer profile does not have permission” | Missing pricing tier | Log in with correct account | Assign proper pricing tier |
| Symptom / Error Message | Most Likely Cause | Immediate Fix | Prevention / Best Practice |
|---|---|---|---|
| Intermittent 403 resolved in incognito | Cached session or extensions | Clear cache; disable extensions | Reduce reliance on browser extensions |
| 403 on embedded checkout / mixed domain | Host/origin validation failure | Use primary domain | Avoid mixed-domain embeds |
| 403 after repeated attempts | Rate limiting / bot protection | Wait and retry | Implement CAPTCHA / reduce retries |
| Symptom / Behavior | Most Likely Cause | Immediate Fix | Prevention / Best Practice |
|---|---|---|---|
| Temporary lockout after multiple requests | Rate limiting / bot detection | Wait for block to clear | Reduce request frequency |
| 403 across all pages for several minutes | IP temporarily blocked | Wait and retry | Avoid repeated automated requests |
| Works in browser, fails in automation tool | Non-human user agent | Use browser | Set Chrome user agent |
| Works after a few minutes | Temporary WAF block expired | Retry later | Avoid triggering patterns |
| Only fails from one IP | IP flagged | Change network / wait | Avoid suspicious traffic patterns |
| Triggered after using Claude / AI cowork tools | Suspicious user agent (Python / headless) | Stop tool; wait for unblock | Configure tool to impersonate Chrome |
| Triggered immediately on script execution | Known bot signature detected | Modify headers | Use browser-like headers + behavior |
FAQ (Expanded)
Customer-Side
Q: Why do I get a 403 during checkout?
A: Typically session timeout, restrictions, or stale checkout state.
Merchant-Side
Q: Why am I getting 401/403 API errors?
A: Usually missing permissions or invalid API credentials.
AI / Automation (New)
Q: Why do I get blocked when using Claude Cowork or similar tools?
A: UltraCart’s firewall detects non-human traffic patterns and blocks them.
Q: What specifically triggers the block?
-
Python user agents
-
Headless browsers
-
Rapid automated navigation
-
Non-browser HTTP clients
Q: How do I fix it?
- Use a real browser user agent:
Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/120.0.0.0 Safari/537.36
-
Slow down request frequency
-
Avoid automating the merchant UI
Q: What is the correct approach for automation?
Use:
- UltraCart REST API (recommended)
Avoid:
- Scraping or automating the merchant portal UI
Conclusion
UltraCart HTTP 403 errors fall into four categories:
-
Customer session / eligibility issues
-
Merchant permissions / authentication
-
Integration / configuration issues
-
Firewall / bot detection (including AI automation tools)
Correct classification ensures faster resolution and prevents repeated failures.