How to fix? Access Denied You don't have permission to access http://www.paypal.com/cgi-bin/webscr

[cndg]

For more than a year now, I get occasional customers who elect to pay me using paypal, but when they click the link on my website which 99% of the time works fine, they instead report to me that paypal shows them this:-

Access Denied
You don't have permission to access "http://www.paypal.com/cgi-bin/webscr" on this server.
Reference #18.c5595068.1537455748.868cf0a

That is not my server showing that message - it's something purporting to be paypal (it says http: in the error, but as far as I know, it's an https: page).

These are intermittent problems, and it's my customers, not me, who suffer them, so I am unable to reproduce them - I only know when my customers are kind enough to tell me - the problem is probably 10x larger (most customers probably don't report this).

Has anyone else seen this? How would I get it fixed?

[DavidSpector1]

The form my website submits to PayPal contains only correct and ordinary information. There are no angle brackets, etc. in any field. Indeed, PayPal payments through my website have been working successfully for 14 years! Only in the past week has it been malfunctioning for all payments, PayPal claims that some operations (it doesn't name them) are temporarily no working due to "technical problem". As I said, this has been going on for several days. PayPal should fix its problems more quickly!

[manuelapopp]

We do have the same problem, for/donate:

---

Access Denied.

You don't have permission to access "/donate...

Reference #0fe834d7-e7c7-43a6-b24b-31dd9eeb687f

Timestamp: 1602770300

---

So far, no solution in sight, neither from Paypal directly nor our web agency.

[DavidSpector1]

I have disabled PayPal as one of our offered payments methods. Since we also offer Stripe, we don't need to offer a PayPal which no longer works and makes our customers frustrated.

[SteveStuartDJ]

I've been having this problem since about the same time as you David and I think I've tried every trick in the book, but my button/sales problem is still on-going, tech support don't know, I've been to many forums, done many searches, opened so many support tickets, it's exasperating! Almost to the point of my health!
My latest idea is to change the ftp permissions to 0755, that was today, but so many customers have been and gone in these last 6 months, I guess most of them won't even bother trying anymore . . . 

[Temp20201028a]

I've been having this same problem for the past few weeks now. NOTHING has changed in my website coding and I have checked everything anyway. When I contact PayPal, they tell ME it is my customers fault and that I should tell them to clear their cache and even try using a different browser. When my customers contact PayPal about the problem, PayPal tells THEM the problem is my website! I've had two different excuses from PayPal and neither of them seem true. "Support" tells me they need to get their Security Department to contact me and then I get an email from Merchant Support telling me I have to tell the customers this is their fault.

I have even been onto our web developer and he has checked everything and he has said "You have changed nothing, I have changed nothing in the coding but PayPal has changed their security settings and this is what has stopped everything working, you need to contact PayPal and ask them to fix the problem as it is their fault." - Great, PayPal does not give a rats about fixing their problem and simply blames the merchants to the customers and blames the customers to the merchants! The common denominator here? PayPal. Their service is nothing short of disgusting and they are costing me to the point where I will go out of business. PayPal, you are a horrible behemoth that needs to look at your despicable behaviour.

[DavidSpector1]

Wow. Well, thanks for confirming the bug.

Big companies whose founders have left to start new ventures get stuck in their ways, unwilling to admit to or fix bugs. They get comfortable raking in the money. Then they coat this with a layer of ignorance called "customer support" whose only function is to shield them from bother. This stage of arrogance is the beginning of the end, because the truth of any situation cannot be hidden for very long. Social sites are just waiting to report news like this.

Meanwhile, my customers are doing fine with Stripe, which offers a variety of website interfaces, great service, great reports. They do cost me a bit more per transaction, but it's worth it to give my customers a working payment ability.

[cndg]

I am pretty sure this is a bug with the PayPal WAF (web application firewall) - the edge-device they must be using for security.

It is anyone's guess how to actually reach anyone inside PayPal tech department to get them to take a look at their logs and work out *which* WAF is broken and/or update whatever seems to be causing those rejections or false positives or whatever is actually going wrong inside the WAF.

[cndg]

The cause is the data your customers are typing into the form.

If they enter anything that the PayPal WAF has banned, this problem comes up.  Things they ban are keywords from the JavaScript and HTML languages, angle-brackets, certain kinds of quotes, etc etc.

[DavidSpector1]

I don't have any way of proving or disproving your claim, since what my customers type in is private, even from me.

But the fact is that none of my recent PayPal customer have been able to complete a PayPal payment due to this error message. Instead of assuming that it is the customer's fault, which I think is unlikely, consider that it might be the fault of my website programming, being suddenly detected by PayPal because of new PayPal software.

In this case, I need specific guidance from PayPal as to what is wrong. Which HTML tag that I am sending to PayPal is causing the problem? Without a helpful error message I cannot fix my website easily and let my customers use PayPal.

PayPal needs to respond to this problem instead of ignoring it. PayPal's unresponsiveness only succeeds in shooting itself in the foot, as the saying goes. It is really, really stupid not to support your developers.

[DDMORE]

This is definitely a problem with PayPal's WAF. I recently made purchases from a vendor and the first two transactions completed with no problem. When I attempted to complete a third transaction, I got the access denied error. I did not enter any information after the first transaction and the first two completed but the third did not through the exact same portal. Vendor thinks everything is fine on his end and I know the problem is not on my end due to the previously completed transaction one immediately after the other and followed by the third witch failed.

Unfortunately PayPal will not admit to any errors in it's WAF and thus will probably not correct the problem until it costs them a LARGE amount of money.

It would appear to be more convenient for PayPal to push the blame for the access denial failure onto the purchaser or the vendor than to actually admit they might have an error in their system. GOOD LUCK TO VENDORS AND PURCHASERS COMPLETING TRANSACTIONS IN THE IMMEDIATE FUTURE UNTIL PayPal FINALLY DECIDES TO TAKE RESPONSIBILITY AND FIX THE ISSUE.