Thank you for the report.
When Admin Tools "excludes" admin-ajax.php, it means the URL itself is never outright blocked — but the WAF still inspects the content of requests sent to it. In your case, the Avada Live Builder is likely sending POST data that triggers one of the WAF's content-inspection rules (e.g. SQLiShield).
To pinpoint the exact rule, please do the following. Go to Admin Tools → Web Application Firewall → Blocked Requests Log. Reproduce the problem (try to save in Avada Live Builder), then refresh the log. You should see a new entry. Note the Reason column — that's the rule that fired.
If you give me the Reason and Target URL I can most likely help you.
Just in case I need more information, you can also open your browser's DevTools (F12), go to the Network tab, and reproduce the save. Find the failing admin-ajax.php request. Click on it and look at the Request tab — this tells us which data was sent to your server. Copy it into a plain text (.txt) file which you can attach with your next reply.
Once I have all the information I can suggest a solution.
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!