Http requests are not enabled. Enable via game settings

What the message means

ServerScriptService.Webhook:9: Http requests are not enabled. Enable via game settings

Other forms of the same message:

• HTTP requests are not enabled. Enable via Experience Settings
• Http requests can only be executed by game server
• HttpService is not allowed to access ROBLOX resources

The switch is the HttpService.HttpEnabled property. Scripts cannot turn it on while the game runs; it is set in Experience Settings.

Even with it on, requests can still fail: the website may be down, block Roblox, or reject your request. Those failures come back as other errors, such as HTTP 403 (Forbidden), so wrap requests in pcall.

Causes and fixes

Three things cause this error in practice. Each one below has the smallest code that triggers it, then the fix.

• Allow HTTP Requests is off
• The request is made from a LocalScript
• The place has never been published

Allow HTTP Requests is off

The default. A webhook, a weather API or a version check works nowhere until the experience allows it.

local HttpService = game:GetService("HttpService")

-- with Allow HTTP Requests off:
-- Http requests are not enabled. Enable via game settings
local body = HttpService:GetAsync("https://example.com/status.json")
print(body)

In Studio, open File, Experience Settings, then Security, switch on Allow HTTP Requests and Save. In your code, wrap the request in pcall so a failure is reported instead of stopping the script.

local HttpService = game:GetService("HttpService")

local ok, result = pcall(function()
	return HttpService:GetAsync("https://example.com/status.json")
end)

if ok then
	print("status:", result)
else
	warn("[Status] request failed:", result)
end

The request is made from a LocalScript

Only the server can send HTTP requests. A LocalScript calling HttpService fails with Http requests can only be executed by game server, whatever the setting says.

local HttpService = game:GetService("HttpService")

-- in a LocalScript: Http requests can only be executed by game server
local data = HttpService:GetAsync("https://example.com/news.json")
print(data)

Make the request in a server Script and send the result to clients with a RemoteEvent or RemoteFunction.

local HttpService = game:GetService("HttpService")
local ReplicatedStorage = game:GetService("ReplicatedStorage")

local getNews = Instance.new("RemoteFunction")
getNews.Name = "GetNews"
getNews.Parent = ReplicatedStorage

local cached: string? = nil

getNews.OnServerInvoke = function(_player: Player): string
	if cached == nil then
		local ok, result = pcall(HttpService.GetAsync, HttpService, "https://example.com/news.json")
		cached = if ok then result else "News is unavailable right now."
	end
	return cached :: string
end

The place has never been published

Experience Settings are saved to the experience on Roblox. A place that only exists as a local file has nowhere to save them, so the setting cannot be turned on there.

local HttpService = game:GetService("HttpService")

-- a local .rbxl file that was never published: the setting cannot be saved,
-- so this still fails with Http requests are not enabled
print(HttpService:GetAsync("https://example.com/ping"))

Publish the place (File, Publish to Roblox), then turn the setting on. Have the script check HttpService.HttpEnabled and say clearly when it is off.

local HttpService = game:GetService("HttpService")

if not HttpService.HttpEnabled then
	warn("[Ping] HTTP is off: Experience Settings, Security, Allow HTTP Requests")
	return
end

local ok, result = pcall(HttpService.GetAsync, HttpService, "https://example.com/ping")
print(ok, result)

How to find the line that causes it

1. Open Output (Window menu, or the Script tab), clear it with Ctrl+K (⌘K on Mac), and press Play.
2. Find the first red line. It starts with the script's place in the Explorer and the line number, such as ServerScriptService.Shop:12:.
3. Click the red line. Studio opens that script with the cursor on the failing line.
4. Read the lines between Stack Begin and Stack End under it: they list the calls that led there, newest first, so you can see which function called the broken one.
5. Still not sure which value is wrong? Add print(typeof(x), x) just above the line, or set a breakpoint on it and read the values in the Watch window.

Questions

Sources and further reading

• Roblox Creator Docs: HttpService
• Roblox Creator Docs: in-experience HTTP requests. Allow HTTP Requests under File, Experience Settings, Security; the Open Cloud subset

How the code was checked: every block marked Fixed passes Luau's strict type checker against Roblox's API definitions (luau-lsp, 23 October 2026), and every block marked Breaks compiles and fails only when it runs. The message wording, including the newer Experience Settings form and the server-only message, was checked against the message strings in Roblox Studio itself (macOS build of 13 October 2026) on 23 October 2026. A type check catches misspelt APIs and wrong types, not game logic, so playtest in Studio before you publish.