Places autocomplete blocked by HTTP referrer restriction

General Geolocation
1

The location autocomplete fails with:
POST https://places.googleapis.com/$rpc/google.maps.places.v1.Places/AutocompletePlaces 403
RpcError: Requests from referer https://courslancer.com/ are blocked.

API key restrictions: HTTP referrers, with courslancer.com/* and
.courslancer.com/ explicitly listed. Also tried https:// variants.

Setting Application restrictions to “None” makes it work immediately.
Enabled APIs: Maps JavaScript, Geocoding, Places (Legacy), Places (New).
Disabling Places API (New) did not change the behaviour.

WordPress 7.1 · HivePress 1.7.31 · Geolocation 1.3.10 · ListingHive

2

Thanks for your message — our team will reply shortly.

In the meantime, you can also get instant help from our AI Assistant, familiar with all the docs and solutions we’ve shared over the years.

4

Hi,

Could you please let us know if you’re restricting the API key or the Secret key?

The key that should be restricted is the API key. To apply the restriction to the entire site, please use the http://dev.local/* format so that the key is restricted to all pages on your website.

Alternatively, you can provide temporary access to your site [please send an email with the link to this topic to support@hivepress.io], and we can temporarily replace your key with a working one to check whether the issue is related to the key configuration or if there is a bug in the extension. You can create a temporary access link using this plugin.

6

Additionally, please make sure that you haven’t enabled Version checkbox in the Integrations tab.

7

Thank you for the quick reply.

  1. I’m restricting the API Key, not the Secret Key.
    The Secret Key field has always been empty.

  2. The “Version” checkbox in Integrations is NOT enabled.

  3. I already use the format you suggested:
    courslancer.com/* and .courslancer.com/
    I also tried https:// variants and the exact subdomain.
    All were rejected with the same error

8

4.Despite the Version checkbox being off, the requests still go to
which is the New Places API endpoint.

5.Setting Application restrictions to “None” makes it work instantly.

I accept your offer of temporary access. I will send the link to
support@hivepress.io. Please note the access will be for my STAGING
site (test.courslancer.com), not the live one.

9

The issue was caused by a corrupted entry in the API key’s website restrictions list. Deleting courslancer.com/* and then adding the exact same value again fixed the issue immediately.

Additionally, Google may sometimes need more time than expected to apply or update API key restrictions, so the changes may not take effect immediately.

10

Thank you, Kseniia — confirmed and working on the live site.