I’m using just BPS Pro, and I have the same error with a referrer, it was the first thing I guess to be the root cause.
I have two custom codes added, one to permit HEAD request and one as the main url of the site has moved
# WP REWRITE LOOP START RewriteEngine On RewriteBase / RewriteRule ^blog/(.*)$ /$1 [R=301,NC,L] RewriteRule ^index\.php$ - [L]
and
# REQUEST METHODS FILTERED # This filter is for blocking junk bots and spam bots from making a HEAD request, but may also block some # HEAD request from bots that you want to allow in certains cases. This is not a security filter and is just # a nuisance filter. This filter will not block any important bots like the google bot. If you want to allow # all bots to make a HEAD request then remove HEAD from the Request Method filter. # The TRACE, DELETE, TRACK and DEBUG request methods should never be allowed against your website. RewriteEngine On RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK|DEBUG) [NC] RewriteRule ^(.*)$ - [F,L]
And as you can see, I have the same issue with the referrer present :
[403 GET / HEAD Request: 23 juillet 2014 - 13 h 50 min] Event Code: BFHS - Blocked/Forbidden Hacker or Spammer Solution: N/A - Hacker/Spammer Blocked/Forbidden REMOTE_ADDR: 70.80.179.32 Host Name: modemcable032.179-80-70.mc.videotron.ca SERVER_PROTOCOL: HTTP/1.1 HTTP_CLIENT_IP: HTTP_FORWARDED: HTTP_X_FORWARDED_FOR: HTTP_X_CLUSTER_CLIENT_IP: REQUEST_METHOD: GET HTTP_REFERER: http://l.facebook.com/l.php?u=http%3A%2F%2Fsuggerebonheur.com%2F&h=TAQGQbo1g&s=1 REQUEST_URI: / QUERY_STRING: HTTP_USER_AGENT: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0