Hi everyone,
I’m running into a really strange issue with a Keap (Infusionsoft) form redirect, and I’m hoping someone here has seen this before.
The Setup
-
Site: WordPress
-
Form: A Keap (Infusionsoft) form embedded on a page.
-
Action: On submit, the form is set to “Redirect to a thank-you page” (a custom web address).
-
Redirect Target: A custom PHP script on our server (e.g.,
http://api.example.com/stripe/checkout.php). -
Keap Setting: The option “Pass contact’s information to the thank-you page” is checked.
-
PHP Script: The PHP script is built to read the
$_GETparameters from the URL (likeinf_custom_NumberOfattendees,inf_custom_FirstName, etc.) and then redirect the user to a specific Stripe checkout link.
The Problem
We’re getting reports that “often” (but not always) users will submit the form and land on a 404 Not Found page.
-
The error is intermittent. For some users, it works perfectly. For others, it seems to fail every time.
-
Clearing cache or using an Incognito window does not fix it for the affected users.
The Mystery (The Main Clue)
When I check our server’s PHP error.log, it is completely empty. There are no errors, warnings, or access logs related to this at all. This makes me think the request is being blocked before it ever reaches our PHP script.
My Theory / Next Steps
I’ve just noticed that our redirect URL in Keap is using http://.
I’m starting to wonder if this is a server-side firewall (ModSecurity / WAF) issue. My theory is:
-
Because “Pass contact’s information” is checked, Keap is sending all user data (like
LastName=O'Malley) in the URL parameters. -
Because the URL is
http://, the firewall can read this plain-text data. -
Is it possible the firewall sees special characters (like an apostrophe
') and is incorrectly flagging it as an SQL Injection attack, then blocking the request with a 404?
This would explain why it’s intermittent (only affects users with special characters) and why my PHP log is empty.
My Questions for the Community
-
Has anyone experienced this specific issue with Keap redirects?
-
Does this “firewall blocking
httpparameters” theory sound plausible? -
Are there any other server configurations I should be checking that could cause an intermittent 404 before the PHP script is executed?
Any insights or ideas would be massively appreciated. I’m stumped!
Thanks!