Hey Haley,
I temporarily registered my site under your license and it got validted. This means there is no problem on our end or our servers.
Below is a list of the usual causes and solutions for this validation issue.
Here is the complete list of possible causes and their solutions formatted as a list:
1. Stale or Cached Security Nonce (_cs_nonce)
-
Cause: Cornerstone generates a temporary security token (
_cs_nonce) when the page loads. If your browser tab was open for a long time, or if a caching plugin (WP Rocket, LiteSpeed Cache, W3 Total Cache) cached the admin page HTML, WordPress rejects the outdated token with a 400 Bad Request.
-
Solution: Log out of WordPress, clear your browser cache and cookies, log back in, and immediately submit your license code again.
2. Hosting Server Outbound cURL or SSL Connection Block
-
Cause: When validating, your server (
hdreporting.com) sends a request behind the scenes via PHP cURL to contact Themeco’s licensing server (theme.co). If your web host blocks outbound connections on port 443, has cURL timeouts, or has outdated OpenSSL certificates, the request fails.
-
Solution: Contact your hosting provider’s support team and ask them to ensure outbound cURL requests to
https://theme.co and https://apex.theme.co are allowed and not blocked by the server firewall.
3. Firewall, WAF, or Security Plugin Interception
-
Cause: Security plugins (Wordfence, iThemes Security) or server/CDN firewalls (ModSecurity, Cloudflare) may flag the POST payload sent to
/wp-admin/admin-ajax.php as suspicious and block it before WordPress can process it.
-
Solution: Check your firewall/security logs. Temporarily set Wordfence/security plugins to “Learning Mode” or deactivate them, and check if Cloudflare firewall rules are blocking the request.
4. Expired Administrator Session or User Permission Issue
-
Cause: Your WordPress administrator session timed out in the background, or the logged-in user account lacks the required
manage_options capability.
-
Solution: Ensure you are logged in using a full WordPress Administrator account, refresh the page to renew your session, and try validating again.