The request sent by Contact Form 7 never reaches the WordPress handler. The web server stops the request and returns a 403 status code. This response indicates that the server refuses to process the submission.
Typical triggers include security rules that flag the form payload as suspicious. ModSecurity signatures, firewall plugins, or .htaccess directives often block POST requests to admin‑ajax.php or the REST endpoint used by the form.
When a nonce is missing or invalid, WordPress treats the request as a CSRF attempt and rejects it with the same status. The same outcome occurs if the REST API is disabled or if file permissions prevent execution of the handling script.
Rate‑limiting mechanisms may also produce a temporary 403 after several rapid submissions. In all cases the browser shows an error toast and no email is sent.