NinjaFirewall (WP Edition) is a web application firewall that inspects all HTTP requests. It can block the WooCommerce add-to-cart request for customized products because the POST data contains a large base64-encoded JSON payload that triggers the firewall's rules.

Symptoms

• Adding a customized product to the WooCommerce cart fails or does nothing.
• Non-customized products add to cart normally.
• The NinjaFirewall log shows blocked requests to the WooCommerce product page or AJAX endpoint.
• The issue appeared after installing or updating NinjaFirewall.

Fix

Option 1: Whitelist the WooCommerce AJAX endpoint

1. Go to NinjaFirewall → Firewall Policies in the WordPress admin.
2. Add the WooCommerce cart endpoint to the whitelist.
3. The endpoint to whitelist is typically /?wc-ajax=add_to_cart or the product page URL.

Option 2: Adjust the POST data size rule

1. Go to NinjaFirewall → Firewall Policies → HTTP POST.
2. Increase the maximum POST data size to allow the large customization payload.
3. Chamevo sends the full product configuration as a JSON string in the cart form data. For complex products with multiple views and elements, this can be several hundred kilobytes.

Option 3: Disable base64-encoded data scanning

1. Go to NinjaFirewall → Firewall Policies.
2. Look for rules that scan or block base64-encoded content in POST data.
3. Chamevo encodes product thumbnails as base64 data URLs in the cart payload. This can trigger NinjaFirewall's base64 detection rules.
4. Adjust or disable these specific rules.

Verify the fix

1. Clear any page caching.
2. Open a product page and customize the product.
3. Click Add to Cart and verify the product is added successfully.
4. Check the NinjaFirewall log to confirm no new blocked requests.

Other security plugins

Similar issues can occur with other security plugins:

• Wordfence — check the firewall log for blocked POST requests and whitelist the endpoint.
• Sucuri — check the activity audit for blocked requests.
• iThemes Security — check the security log and adjust file upload or POST data rules.

The general approach is the same: find the blocked request in the security plugin's log and whitelist the specific endpoint or adjust the rule that triggered the block.