Hello @harrycustom
Hmm, do you happen to have some logs on hand that could shed some light on the situation? I have a theory why this might be happening, which would be a low application memory limit with the hosting service, but we’d need to fully confirm this.
Do you think you could start by running WordPress’ debugging mechanism: https://developer.wordpress.org/advanced-administration/debug/debug-wordpress/ and see if there is anything in the generated log? You will need to turn on all wp_debug, wp_debug_display and wp_debug_log features.
Thanks.
Hi Eduard, I don’t think it is a memory issure, checking wp-options.php we have:
define( ‘WP_MEMORY_LIMIT’, ‘256M’ );
I’ve enabled WP_DEBUG and no errors occurr.
The server log shows this error (I use, as a matter of privacy, http://www.website.it instead of the actual url of the site):
[client 217.198.135.183] ModSecurity: Access denied with code 403 (phase 4). Match of “rx (?:\\\\b(?:gif|(?:cws|f(?:lv|ws)|i(?:d3|hdr|nterplay)|m(?:ovi|thd)|r(?:ar\\\\!|iff)|varg|(?:ex|jf)if)\\\\b)|B(?:%pdf|\\\\.ra)\\\\b)” against “RESPONSE_BODY” required. [file “/etc/httpd/conf/modsecurity.d/rules/comodo_free/15_Outgoing_FilterASP.conf”] [line “14”] [id “214450”] [rev “2”] [msg “COMODO WAF: ASP/JSP source code leakage||www.website.it|F|3”] [data “Matched Data: <% found within RESPONSE_BODY: <!doctype html>\\x0a<html lang=\\x22it-IT\\x22>\\x0a<head>\\x0a\\x09\\x0a\\x09<meta charset=\\x22UTF-8\\x22>\\x0a\\x09<meta name=\\x22viewport\\x22 content=\\x22width=device-width, initial-scale=1, maximum-scale=5, viewport-fit=cover\\x22>\\x0a\\x09<link rel=\\x22profile\\x22 href=\\x22https://gmpg.org/xfn/11\\x22>\\x0a\\x0a\\x09\\x09\\x09\\x09<script type=\\x22text/javascript\\x22 class=\\x22_iub_cs_skip\\x22>\\x0a\\x09\\x09\\x09\\x09var _iub = _iub || {};\\x0a\\x09\\x09\\x09\\x09_iub.csConfiguration…”] [severity “ERROR”] [tag “CWAF”] [tag “FilterASP”] [hostname “www.website.it”] [uri “/index.php”] [unique_id “Z2FDYTdQ-bLiQaWLGu6mlAAAAJE”], referer: https://www.website.it/wp-admin/customize.php?return=%2Fwp-admin%2Fadmin.php%3Fpage%3Dct-dashboard&theme=blocksy-child
Thanks in advance.
Best regards.
Hello @harrycustom
Ah, there we go. The good old mod_security problem. 🙁
Unfortunately, this is a known problem of mod_security where it falsely flags some parts of our software. It would be recommended to disable mod_security or at least make it exclude the Customiser paths from being scanned.
Moreover, mod_sec has reached EOL and was transitioned to the community to be maintained, which would make its future uncertain.
Hope this clears things up!
Thanks.
Thank you very much, solved deactivating Mod security!
Thank you as well, @harrycustom 🙇♂️
