A mixed-content warning appears when an HTTPS WordPress page references some resources over HTTP. After switching to Cloudflare, the browser can block scripts, fonts or images even while the site’s padlock appears otherwise correct.
If a WordPress editor reports a 403 or AJAX failure, do not immediately turn off Cloudflare protection. First capture the exact request and find whether the block came from Cloudflare, a WordPress security plugin, a server firewall or
A blocked AJAX call may stop a page builder from saving, interrupt an admin form or break an authenticated interaction. A precise diagnosis is safer than turning off a firewall for every visitor.