A 403 error means Access Forbidden: the server refused the request. After a payment, this usually means a security tool of the site or the server blocks the address the payment provider sends the customer back to, or the webhook of the payment provider.
RO Payments uses the addresses /notify and /customer of the site, see
Notification URLs. Both must be reachable without logging in.
Check these:
- Admin Tools: look in the log of the Web Application Firewall for blocked requests to
/notifyor/customer. Turn off the feature that blocks them, or add an exception. With the .htaccess Maker, make sure these addresses are not blocked. - .htaccess: rules that block query strings or POST requests can block the payment provider.
- The firewall of the hosting, such as ModSecurity: ask your hosting provider to look in the firewall log for the time of the payment.
The transaction log shows whether the request of the payment provider reached RO Payments. When the log has no entry for the webhook, the request was blocked before it reached Joomla.