The Solo Workout beta signup page loaded fine. Submitting the form from a browser returned a 403. I found it while getting the app ready for its first Instagram ad.
I’m building Solo Workout for people who have lifted before and want a simple plan for getting back to the gym. I had opened signups for the free iPhone beta and wanted to start recruiting testers.
What the browser sent
The form posted to the same site. The page’s Referrer-Policy: no-referrer header made the browser send Origin: null with the form submission. The server rejected it. The logs showed both the missing origin and the browser’s Sec-Fetch-Site: same-origin header. How browsers set the Origin header
I switched the policy to same-origin. People who had already loaded the old page can still submit if their browser identifies the request as same-origin. A page-load check had covered the GET. For signup changes, I’ll also check that a browser can submit the form and reach the thank-you page.
Saving the signup comes first
The site now saves the email address before it tries to notify me. If email delivery fails, the signup stays saved and the server retries the notification. Submitting the same address twice still creates a single signup. The delivery test reached my inbox.
What I’ll measure next
I set a total budget of 300 PLN for seven days of Instagram Reels and Stories in the U.S. The ad opens Instagram’s own email form. The signup on this blog goes through the Solo Workout site, so I’ll count those signups separately from the paid leads.
When the test is over, I’ll share what I spent, how many people signed up through the ad, and what I’d try next.