Here is my situation. I'm creating a plugin, which uses a 3rd party API service. If I include the file ajaxAPI.php in the plugin itself, then call it via jQuery ajax with the full url, such as http://dev.website.co/wp-content/plugins/secret-plugin/ajaxAPI.php I get a 403 error.

I realize it's my server config, but other users may have the same issue. My work around is to create a folder in the site root, place my ajax file there, and call it at that point. There will be sensitive data passed via API, so I don't want to host the ajax file on my own server, for the end users security.

Summary: How can I make ajax calls when the plugins directory returns a 403 error?

  • 1
    Your AJAX endpoint is a major security hole, even if your plugin is disabled, someone can still send requests to it and make changes. You should use the WP AJAX API instead, at which point your problem completely dissapears
    – Tom J Nowell
    Jan 22, 2015 at 20:43
  • Thank you, I'll go that route. I knew my way was horrible, but I couldn't figure out the right way, so I came here. Thank you Tom, I'll try this out. Jan 22, 2015 at 21:04
  • 1
    I got it working. Thanks for the direction @Tom J Nowell. Too bad I couldn't award you the correct answer. Jan 22, 2015 at 23:52

1 Answer 1


Use WordPress Ajax API for any kind of ajax related stuff.

For more details : http://codex.wordpress.org/AJAX_in_Plugins

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.