• Resolved flyfisher842

    (@flyfisher842)


    1. url http://www.successfulflyfishing.com/elearning/
    2. sitecheck.sucuri.net
    3. on only this site, when the line in htaccess for the 403 is active, sucuri shows a 500 header error and so does every header tool, I tried.
    ErrorDocument 400 /elearning/wp-content/plugins/bulletproof-security/400.php
    ErrorDocument 401 default
    #ErrorDocument 403 /elearning/wp-content/plugins/bulletproof-security/403.php
    ErrorDocument 404 /elearning/404.php
    4. I know this is the problem child becuase I went thru the htaccess file and commented out each code line until I found the one causing the 500 error.
    5. While sucuri may be correct, I may have a hack problem to worry about, I compared the BPS 403 in elearing to the BPS 403 from another site with notepad++ and they are identical and the other site was fine in the sitecheck test.

    So I will leave this up to smarter people than me and get some sleep.

    https://wordpress.org/plugins/bulletproof-security/

Viewing 15 replies - 1 through 15 (of 23 total)
  • Plugin Author AITpro

    (@aitpro)

    What you want to eliminate first is that a parent htaccess file is actually the root cause of the problem. See this forum topic link and create a child site RewriteRule (exclude/skip) rule in the parent .htaccess file for the elearning child site: http://forum.ait-pro.com/forums/topic/htaccess-files-for-multiple-website-domains/

    Example:

    # WP REWRITE LOOP START
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]
    
    # Do not apply rules to other child websites &
    # do not log errors for these child sites
    RewriteRule ^elearning/ - [L]
    Thread Starter flyfisher842

    (@flyfisher842)

    This is what is in the htaccess chain. Is this what you mean?

    In account root htaccess
    # Do not apply rules to other child websites &
    # do not log errors for these child sites
    RewriteRule ^successfulflyfishing/ – [L]
    RewriteRule ^successfulflyfishing/elearning/ – [L]

    In successfulflyfishing htaccess
    # Do not apply rules to other child websites & # do not log errors for these child sites
    RewriteRule ^elearning/ – [L]

    In elearning htaccess
    # WP REWRITE LOOP START
    RewriteEngine On
    RewriteBase /elearning/
    RewriteRule ^index\.php$ – [L]

    Plugin Author AITpro

    (@aitpro)

    In the hosting account root htaccess file code change the code to this below by removing the RewriteRule ^successfulflyfishing/elearning/ - [L] RewriteRule. all the other code you posted is good.

    # Do not apply rules to other child websites &
    # do not log errors for these child sites
    RewriteRule ^successfulflyfishing/ - [L]

    Ok so I am not seeing any errors right now when using the Sucuri Sitecheck scanner so I assume you still have Security Logging/ErrorDocument commented out. The only common problem that I am aware of with ErrorDocument Security Logging/redirects is when you are using mod_security and in that case you probably want to allow mod_security to handle error logging or most likely you will end up with redirect looping problems or you would disable mod_security and allow BPS to handle error logging instead. Are you using mod_security?

    Thread Starter flyfisher842

    (@flyfisher842)

    Not intentionally. This one site is the only one I have problems with. All my other test sites are fine but are only one layer down from account parent. I would think if my host turned on mod_security, it would cause similar problems in all my WP sites as they are run the same. BPS plugins, htaccess with all the bruteforce protection code and xmlrpc and the author code.

    I have removed the successfulflyfishing.com/elearning/ from the account root htaccess and have uncommented the 403 in the elearning subfolder in successfulflyfishing.com

    I do have another folder called elearning that is one layer down from the account root but I would not think that is a problem.

    Also try a regular header check and see if you get a 301 on the xmlprc redirecting back to the successfulflyfishing.com/elearning/ folder.

    Plugin Author AITpro

    (@aitpro)

    Yes. You are correct. I am not aware of any other ErrorDocument issues/problems besides the known one with mod_security and BPS Security Logging trying to do the same thing – error logging.

    Headers check using GET result is a 500 error:

    HTTP Status Code: 500 Internal Server Error

    Headers: Array
    (
        [date] => Thu, 09 Apr 2015 00:49:21 GMT
        [server] => Apache
        [expires] => Thu, 19 Nov 1981 08:52:00 GMT
        [cache-control] => no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        [pragma] => no-cache
        [set-cookie] => PHPSESSID=lmghcvb5t5jj13ae1q5om8o4a0; path=/
        [vary] => Accept-Encoding
        [content-encoding] => gzip
        [content-length] => 702
        [connection] => close
        [content-type] => text/html
    )

    Logically I believe you have invalid/bad custom code somewhere.
    Do these troubleshooting steps:
    http://forum.ait-pro.com/forums/topic/read-me-first-free/#bps-free-general-troubleshooting

    Note: After doing each troubleshooting step, test whatever is not working to see if it is now working. It could also be possible that 2 things are causing a problem. Example scenario: Doing step 2 and step 3 allow whatever was not working to start working. That would mean both the root .htaccess file and the wp-admin .htaccess file are blocking something legitimate.

    1. Optional (not necessary): Make a backup of your .htaccess on the htaccess Core >>> Backup & Restore tab page.
    2. On the Security Modes page, select the Deactivate Root Folder BulletProof Mode (Default Mode) Radio button and click the Activate|Deactivate button.
    See Custom Code Note
    3. On the Security Modes page, select the Deactivate wp-admin Folder BulletProof Mode Radio button and click the Activate|Deactivate button.
    See Custom Code Note
    4. If an issue/problem is related to Login Security turn Off Login Security on the Login Security & Monitoring page.

    Custom Code Note: If you have isolated a problem to the root or wp-admin .htaccess file and you have added additional custom .htaccess code or additional .htaccess code from another plugin to BPS Custom Code then cut (not Copy) all of your additional custom .htaccess code out of all BPS Custom Code text boxes and save that custom .htaccess code to a Notepad or Notepad++ text file, Click the Save Root Custom Code button (or the wp-admin Custom Code button), click the AutoMagic buttons on the Security Modes page and activate BulletProof Modes. You can then further isolate which custom .htaccess code is the problem by adding only 1 block of additional custom code back to a BPS Custom Code text box at a time.

    Plugin Author AITpro

    (@aitpro)

    And meant to say do the Custom Code troubleshooting steps specifically since I believe the problem is bad/invalid custom code.

    Thread Starter flyfisher842

    (@flyfisher842)

    I checked with my web host and they are running mod_security on my account. That being the case, then I should have had trouble with all my other wordpress installs when checking against sitecheck and I don’t.

    I have removed all custom code from the elearning htaccess and regenerated a fresh copy using automagic for the elearning root and wpadmin.

    I have turned off the root access and the 500 error goes away so there is some code in the basic generated htaccess that is causing this problem. There is no custom code in the elearning htaccess I am using.

    The first time thru the sitecheck after this procedure gives a good result. On doing a force recheck on securi, I am back to the 500 error problem. When I rename the elearning so there is no htaccess, the 500 goes away and stays away.

    It also goes away under this procedure
    After turning off the root htaccess, the replacment is Rewritebase / for the loop. So is this the hosting account root or the successfulflyfishing root which is an addon domain.

    So it appears to me that there is some error in the code generated for the elearning htaccess.

    This may be relevant. Ever since I installed this particular wp install, on login I get a cookies message are not enabled message which never shows up on any of my other installs.

    Plugin Author AITpro

    (@aitpro)

    None of the standard BPS htaccess code causes an error with Sucuri Sitecheck. BPS standard code is “standard” meaning that it will always generate the same standard BPS code/files every time if you are not using any custom code. So obviously there is some other factor involved in the equation.

    Try reinstalling WordPress.
    If you are using a caching plugin then double check that everything is setup and working correctly or disable/deactivate it for testing.

    Plugin Author AITpro

    (@aitpro)

    Also check your php error log and server log for clues.

    Thread Starter flyfisher842

    (@flyfisher842)

    Don’t have time for that. I will just move web hosts which is what they want anyway.

    Plugin Author AITpro

    (@aitpro)

    Ok but these things should be fairly quick to do.
    Reinstalling WordPress takes about 1 minute >>> Dashboard >>> Updates >>> Re-Install Now button. I took a look at the site. You should eliminate the theme by switching to another theme and back again. You should eliminate this plugin – wp courseware. There are reasons why I think doing these things is worth trying and I won’t bore you with the technical logic of doing this things. Intermittent problems typically indicate a caching problem. Cookie problems can also be caused by a caching problem. I do not see a caching plugin installed on this site based on the Source Code.

    Plugin Author AITpro

    (@aitpro)

    So since the standard BPS code does not cause 500 errors with Sucuri Sitecheck then there is some other factor involved. could be something like X + BPS = 500 error. Finding X is what you want to do. or WP is not installed fully or is damaged and WP + BPS = 500 error. The point – there is obviously another factor in the equation.

    Thread Starter flyfisher842

    (@flyfisher842)

    I can’t eliminate wpcourseware. I paid 100 for it to build onlne courses. It is the reason for this site. I can deactivate it and see what happens. If you mean eliminate temporarily for testing, I can do that.) The files the Antivirus identified in wpcourseware are the pdf parsers for outputting completion certificates. I will let the developers know about a possible problem.

    I just ran plgavp_Antivirus on this site and it did not find anything wrong with the files.

    But I agree there is something causing the 500 error. The intermittent part sounds like a new malware sucuri was talking about yesterday. A variation of another that uses an iframe but the new version is using dynamic ipless dns servers which makes it hard to track down.

    ++++++++++++++++++++
    All this said, I have eliminated all the custom code out of the successfulflyfishing.com htaccess without affecting the 500 error on the successfulflyfishing/elearning site.

    Now I do have this site fly-fishing-colorado.com/elearning/ with an exception rule in the account root htaccess. Could this be causing a problem with the success/elearning somehow?

    Thread Starter flyfisher842

    (@flyfisher842)

    I can also test wpcourseware on another site and see what happens there. If I get similar results to what is happening now, that would pretty much confirm a problem. Good site to problems, I mean.

    Thread Starter flyfisher842

    (@flyfisher842)

    Maybe this means something. The bps log has been showing this since I set this site up. I don’t use a captcha on the login page. and bps should not be showing me as a spambot.

    [Login Form – POST Request Logged: 02/20/2015 – 10:29 pm]
    CAPTCHA Entered:
    BOT/HUMAN: Most Likely a SpamBot
    REMOTE_ADDR: “my static ip address from my isp
    Host Name: “my static ip address from my isp.myisp
    SERVER_PROTOCOL: HTTP/1.1
    HTTP_CLIENT_IP:
    HTTP_FORWARDED:
    HTTP_X_FORWARDED_FOR:
    HTTP_X_CLUSTER_CLIENT_IP:
    REQUEST_METHOD: POST
    HTTP_REFERER:elearning login info
    REQUEST_URI: elearning uri
    QUERY_STRING:
    HTTP_USER_AGENT: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0

Viewing 15 replies - 1 through 15 (of 23 total)
  • The topic ‘BPS 403.php and sucuri’ is closed to new replies.