same problem on cloudflare, a 403 seen on click of button.
but after down debugging i found out that it due to the well-known incompatibility between caching and nonces that the plugin uses on the front end of non-logged in users.
so i cleared stale cache (>24hrs) because a WordPress generated nonce validity is up to 24hrs. then each fresh page came a newly generated nonce which worked for anonymous users.
so the solution would be to either remove the nonce on the front end for non-logged in users, or to disable caching (CDN and/or caching plugins) for articles’ HTML which would be hard.
Joel, i read that best practices recommend using nonces for Ajax loading (your plugin uses a POST to admin-ajax) but since we’re not doing any puts or deletes so can we have an option to remove the nonce entirely?
Thanks for the great plugin!