Your map says “Access blocked”? Why, and how to fix it

For WordPress and other sites that show OpenStreetMap tiles. Checked 28 September 2026.

If the map on your site has turned into grey squares that say Access blocked or Referer is required, the map data is fine and nothing is wrong with your plugin. The tiles come from OpenStreetMap's own servers, and those servers now refuse your site. There is a free fix, and if you would rather not depend on them, a replacement that takes two minutes.

Why it happens

OpenStreetMap's tile servers are run by volunteers and are free for light use under a tile usage policy. Since March 2026 the policy is enforced: every tile request must say which site it comes from (the Referer), and heavy use, bulk downloading and a missing credit are blocked too. Most blocked WordPress sites send no address at all, usually because a security plugin or the host sets a strict Referrer-Policy header.

The free fix: let your site say where it is

1. Check the header. In a terminal: curl -sI https://your-site.example | grep -i referrer-policy. Or open the page, press F12, open Network and click any tile. no-referrer or same-origin is the cause.
2. Change it to strict-origin-when-cross-origin, which is what browsers do when no one sets anything. In a security plugin, look for “Referrer Policy” among its security headers. On Apache, in .htaccess: Header always set Referrer-Policy "strict-origin-when-cross-origin". On nginx: add_header Referrer-Policy "strict-origin-when-cross-origin" always;

The tiles come back. They are still meant for light use: for a business site with steady traffic, OpenStreetMap asks you to use a tile provider or your own server.

Keep your plugin, swap the tiles

Any plugin that takes a tile URL works with ours: the same OpenStreetMap data, in six looks, with a key that only works on your site. It is free for 20,000 map loads a month, with every 50 tiles counted as one load, and there is never an overage bill.

1. Create a free account, then Keys → New key → Publishable, and add your site's domain to the key's allowed sites.
2. Your tile URL, with your key in place of pk_…:

   https://tiles.deltabreen.eu/raster/meadow/256/{z}/{x}/{y}.png?key=pk_…

   Swap meadow for midnight, neon, vintage, blueprint or sakura for another look.
3. Paste it into your plugin:
   • Leaflet Map: the default tile URL on its settings page, or for one map, [leaflet-map tileurl="…"].
   • WP Go Maps: Maps → Settings → Advanced, then the tile server's Custom (Enter URL) option.
   • Other Leaflet or OpenLayers plugins: the “tile layer” or “tile server” URL setting.
4. Keep the credit line: © OpenStreetMap contributors, and on the free plan Maps by DeltaBreen after it.

Our tiles check the same site address, so if your site sends none, do the free fix above first. More about raster tiles, including 512-pixel tiles, sharper tiles for high-density screens and other languages.

Or use our plugin

Maps by DeltaBreen draws sharp vector maps and works even on sites that hide their address. Press Connect and your site gets a key of its own, with nothing to copy. It adds a Map block with up to 5,000 pins, a store locator, and Check my key, which says exactly what to fix when a map does not show.

Questions

Is OpenStreetMap going away? No. The map data stays free and open; only the volunteers' own tile servers are strict about who uses them, and how much.

Will the fix break anything else? strict-origin-when-cross-origin is the browser default, so other sites learn only your domain, never the page or the query string.

What does it cost? Nothing up to 20,000 map loads a month. Past that, banked loads and a surge pool carry you and top-ups are optional; on the free plan, new maps then pause until the month ends. There is never an overage bill. Pricing.