Disable ModSecurity in cpanel.
HTTP 403 is an HTTP status code meaning access to the requested resource is forbidden. The server understood the request, but will not fulfill it, if it was correct.
Cloudflare 'under attack mode' was blocking it.
https://stackoverflow.com/questions/58958490/php-paypal-ipn-returns-http-403-error-since-12-nov-2019
Problem was ModSecurity in cpanel https://cpanel.net/blog/tips-and-tricks/how-to-install-and-configure-modsecurity-in-cpanel/
PayPal IPN notification history https://www.paypal.com/merchantnotification/ipn/history
PayPal IPN simulator https://developer.paypal.com/dashboard/ipnSimulator https://developer.paypal.com/api/nvp-soap/ipn/IPNSimulator/ https://developer.paypal.com/api/nvp-soap/ipn/IPNOperations/
https://developer.paypal.com/api/nvp-soap/ipn/IPNImplementation/ https://github.com/paypal/ipn-code-samples/blob/master/javascript/googlescript.js
PayPal system will send the IPN response logs to the specific IPN endpoint URL which merchant passed in their website API request call.
If your (merchant) IPN listener server fails to return HTTP 200 OK response to PayPal POST, system will retry sending the IPN details for 16 times by auto alerting the merchant via email. This is the reason why you received the IPN warning email alert.
Please refer the detailed guide link to resolve the issue -
https://developer.paypal.com/docs/api-basics/notifications/ipn/IPNTesting/?mark=ipn%20trou#ipn-troub...
If you notice many Failed or Retrying entries, it is likely that the reason behind the delay in IPN failure to send HTTP 200 OK responses. To resolve this issue, you should review your server logs to identify why the required HTTP 200 OK responses are not being sent and fix your listener accordingly. Once your listener starts sending the required HTTP 200 OK responses, PayPal will post IPNs from the faster-cycling server.
If your still facing issues, please create an MTS ticket via - https://www.paypal-support.com/s/?language=en_US with the detailed information and error details.