Return 403 if request doesn't come from WordPress