Please do these:
– disable “Directory List” option in Hiding tab
– disable “Hide PHP Files” option in Hiding tab
– empty out “Ajax URL” field in Permalinks tab
– empty out “API Base” and “API Query” fields in Permalinks tab
– if it’s still the issue then try disabling IDS option in Protection tab
Let us know!