Plugin version: 3.1.8.7
Immediately after updating to 3.1.8.7, my Pro Forms started failing on submission with the error: “REST API authentication is disabled for remote access.”
Bricks native forms continued to work
I cleared cache and the issue persisted — not the cause.
Not a global/reusable Bricks element — built directly on the page.
Not inside a popup or lazy-loaded/AJAX-injected content — rendered in normal page flow.
Cloudflare Turnstile spam protection was enabled via Bricksforge.
Disabling Turnstile In the backend in Bricksforge>pro forms>settings resolved the issue immediately — the form now submits without error.
Could you confirm whether this is a known side effect of the 3.1.8.7 patch, and let me know if there’s a fix planned, or a recommended workaround for keeping Turnstile enabled without breaking submissions?
thanks for the detailed report — that made it easy to narrow down.
First, to reassure you: this is not a known side effect of 3.1.8.7. That update was a security hotfix that hardened the server-side input processing of Pro Forms (field validation, registration action, option actions). It didn’t touch the Turnstile integration or the way Pro Forms authenticates its requests at all.
The important clue is the error message itself: “REST API authentication is disabled for remote access” is not a Bricksforge message — that string doesn’t exist anywhere in our codebase, nor in Bricks or WordPress core. It comes from something else on your site (typically a security plugin with a “disable REST API for unauthenticated users” option, or a firewall/WAF rule).
Some background on why this hits Pro Forms specifically:
Pro Forms submits via the WordPress REST API (/wp-json/bricksforge/v1/form_submit).
Native Bricks forms submit via admin-ajax.php instead — that’s why they keep working while Pro Forms gets blocked.
Regarding Turnstile: whether Turnstile is enabled or not, Pro Forms sends the submission to the exact same REST endpoint with the same headers. The only difference is that, with Turnstile enabled, the request payload additionally contains the Turnstile token. So the block you’re seeing isn’t caused by our Turnstile handling itself — it looks like a security rule on your site is triggering on those requests.
Could you check which security plugin or firewall you’re running (anything with REST API restrictions, e.g. a security suite or a WAF)? The recommended fix is to allowlist the bricksforge/v1 REST namespace (or at least the form_submit route) there. After that, you can safely re-enable Turnstile.
One more thought: since 3.1.8.7 didn’t change anything in this area, the timing might be coincidental — e.g. a security plugin that updated around the same time or a setting that changed. If you tell me what’s in your security stack, I’m happy to help you pin it down.
Thank you so much for offering to help - I love the WordPress community and its developers!
You gave me the additional clues I needed to find a solution. My LoginPress Pro limit login attempts was the REST API issue. Found you in there and whitelisted it. Thanks again!
