.htaccess permissions changing and 403 error

ok i read through the other thread. it is very unlikely that your Host is locking the root .htaccess file with 404 permissions. Typically hosts go the other direction and try to unlock / change file permissions to 644.

I see you are using the Yoast SEO plugin. That plugin incorrectly wipes out the root .htaccess code because the WordPress flush_rewrite_rules function is being used inappropriately/incorrectly.
http://forum.ait-pro.com/forums/topic/read-me-first-pro/#flush-rewrite-rules

Another person has reported to me that this line of code – RewriteCond %{HTTP_USER_AGENT} ^$ causes a problem for Network/Multisite specifically and not single standard WordPress sites. Comment out the line of code as shown below with a pound sign. And you also need to remove the [OR] flag as shown below for the HTTP_REFERER.

# FORBID EMPTY REFFERER SPAMBOTS
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} (wp-comments-post\.php)
RewriteCond %{HTTP_REFERER} !^.*ait-pro.com.*
#RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule .* - [F]

But with that said you need to isolate the plugin that is changing the root .htaccess file permissions automatically. Or another possibility is that BPS has been Network Activated. BPS should not be Network Activated and ONLY activated on the Primary site.

Well first try deactivating the Yoast SEO plugin and then use AutoMagic and activate your Root Folder BulletProof Mode and see what happens at that point. Do you have any other plugins that write .htaccess code?

I just thought of something to test. Use the AutoLock Off button and turn AutoLock Off. Then check if the root .htaccess file is still being locked.

I doubt that file permissions are going to be related to 403 errors when posting comments. This is the regular BPS version and not the Pro version correct?

You are absolutely sure that you are on the Primary site correct and not a subsite?

Have you done these troubleshooting steps to see if the BPS htaccess code is causing the comment post errors?

1. Make a backup of your .htaccess files using BulletProof Security built-in Backup.
2. Activate Default Mode on the Security Modes page.
3. Use the Delete wp-admin .htaccess feature on the Security Modes page.
4. Test your plugin or theme.
5. Restore your .htaccess files using BulletProof Security built-in Restore.

Try commenting out the entire block of # FORBID EMPTY REFFERER SPAMBOTS htaccess code and also check that you have not blocked your IP address in this code

<FilesMatch "^(wp-comments-post\.php)">
Order Allow,Deny
Deny from 46.119.35.
Deny from 46.119.45.
Deny from 91.236.74.
Deny from 93.182.147.
Deny from 93.182.187.
Deny from 94.27.72.
Deny from 94.27.75.
Deny from 94.27.76.
Deny from 193.105.210.
Deny from 195.43.128.
Deny from 198.144.105.
Deny from 199.15.234.
Allow from all
</FilesMatch>

LOL yep Legend in my own mind that is me. ha ha ha.

I grabbed that Spambot code from WP and to tell you the truth it did not do the trick on my site because I was having epedemic Spam Comment problems to the tune of 60,000 spam comments per month. So I created another solution for myself, but it is not ready for public use/release. I have been testing it for the last 3 months and 4 Spam comments have gotten through my new “thing” instead of the 180,000 spam comments that i would have had to deal with. 😉

So you can ditch that code altogether. Spam commenters have already figured out how to beat it. 😉 And even the IP address thing I tried was also not effective. I am not a big fan of trying to block by IP Addresses and that test was just a reminder of why i never bother with that route/direction/method – it is easily beaten. My new “thing” on the other hand is basically unbeatable because it uses the only method that i have ever found to work – an Action approach – dummy X does bad action Y and Z is the result = Forbidden.