---
title: Session endpoint returns 403 for some visitors
description: "You may see some requests to **POST /wp-json/hrck/v1/session/ensure** return a 403 in your server logs. **Why this happens.** The 403 comes from the…"
url: "https://homerunner.io/docs/why-does-post-wp-json-hrck-v1-session-ensure-return-403-for-some-visitors/"
updated: "2026-10-26"
category: API and data
---

# Session endpoint returns 403 for some visitors

You may see some requests to **POST /wp-json/hrck/v1/session/ensure** return a 403 in your server logs.

**Why this happens.** The 403 comes from the Conversion Kit's own security check on the session endpoint. The endpoint only accepts requests from a page served on your site's own address. When a visitor views your site through a different address, such as the Google Translate proxy (translate.goog), a staging domain, a preview tool, or an embed, the browser reports that other address and the request is refused. In those views the browser could not store your site's session cookie anyway, so no tracking is lost that could have been kept. Page visits still record for those visitors because the visit endpoint does not have this check.

**Identifying affected visitors.** Check the referer column in your server logs. A translate.goog referer means a Google Translate view. An empty referer with a normal browser user agent means an embed or a client that strips headers. Datacenter IP addresses are scanners.

**What you can do.** Update to Conversion Kit 1.147.5 or later. From that version, the plugin no longer sends the session request from pages viewed under another address, which eliminates these 403 entries.

Still stuck? [Contact the HomeRunner team](https://homerunner.io/contact/) with your site address and what you tried, and we take it from there.