When you click Update or Publish in Elementor the editor sends a POST request to the REST endpoint /wp-json/elementor/v1/. If the server returns status 403 the editor shows a toast that reads Server Error (403 error). The page does not save and the editor reverts to the previous version.
A 403 response means the server refused the request. The refusal usually originates from a security layer that blocks the payload. Elementor includes HTML, script tags, data URIs, or the nonce header in the request. Security rules that look for XSS patterns treat those elements as malicious and stop the request before WordPress processes it.
The block also happens when the file system does not allow WordPress to write temporary files. ModSecurity, Cloudflare Managed Ruleset, Wordfence, or other WAFs generate rule IDs that match the Elementor payload. When the rule triggers the server returns 403 and the editor cannot complete the save.
Rate limiting or IP blocking adds another layer. Rapid saves exceed the limit and the firewall returns 403 for the next request. The result is the same toast and no changes stored.