Astro's checkOrigin blocks POSTs when the served hostname isnt in its allowlist, which is exactly what happens behind an Appwrite custom domain. The fix: put the exact HTTPS hostname into Astro's security.allowedDomains and keep checkOrigin enabled.