gore.m

OK thanks you.-)

I know and I agree. I forgotten to write “I got it working” – but with lower my demands.

If I understand it right using ‘unsafe-inline’ with CSP is counter-productive.(?)
So…inline JS and CSS were the most painful parts… the best way – and maybe only one – was to use ‘self’ and aggregate all inline JS and CSS by Autoptimize.

But than I realised that I would rather dont aggregate cart and checkout page and that I need run <script> jQuery function </script> before content is loaded (so that I hardcoded it in header template)… and Im in troubles… than I realised: Is not everything escaped yet? So… Do you think is it worth it in my case?

Maybe… main problem is that I dont exactly understand how XSS works… is it possible injects anything without input boxes etc?

Thanks you

Are you sure youve changed url like this? If yes, and initial url doesnt workk too, you need to login to FTP and delete wps-hide-login plugin folder from here, than initial login url will work again.

Im afraid I dont understand you @nicolaskulka too right now .))

If I set up new login to “login”, url is https://www.example.com/TEMP/cs/login/, if I open this url = 404.
Log out url is https://www.example.com/TEMP/cs/login/?action=logout&_wpnonce=688c5e3c9b = 404. I cant log out, Im still logged in.

If I remove ‘cs’ slug from url ( https://www.example.com/TEMP/login/ ) it redirects me to https://www.example.com/TEMP/wp-admin/.

I can log out only with URL without ‘cs’ slug, but than Im redirected to https://www.example.com/TEMP/cs/login/?loggedout=true = 404.

After that action I can access https://www.example.com/TEMP/login/ but I cant log in, because Im redirected to https://www.example.com/TEMP/cs/login/ = 404… So I have to delete WPS from FTP.

I think it is obvious that URLs with ‘cs’ slug are pointing to nowhere = 404. Hard to tell what is causing this problem, because rest of site works perfect.

I was curious if and how other similar plugins will work… I had similar problems with them, only Hide WP Admin and Login plugin works without problem, I can log-out and log-in if I remove ‘cs’ slug from log-in URL.

• This reply was modified 8 years, 1 month ago by gore.m.

Thanks you very much,
I was confused by marks like XSS, that are “same” in Wordfence settings. I ended up with “Security Headers” plugin yesterday, that solved this problem. But it is cool to see headers can solve few .htaccess lines .-)
One thing Im still confused are coockies. I inspected coockies and I found out that only one is “secure; HttpOnly”, the rest (included Woocommerce, WPML and others) are not secure.

Ive tried :

<IfModule mod_headers.c>
  Header always edit Set-Cookie (.*) "$1; HTTPOnly; Secure"
</IfModule>

<IfModule mod_headers.c>
  Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
</IfModule>
 

It didnt changed anything.

Than I find out some conection to line from your code Header always append X-Frame-Options SAMEORIGIN (I already have it in header) and this tip:

@ini_set('session.cookie_httponly', true);
@ini_set('session.cookie_secure', true);
@ini_set('session.use_only_cookies', true);

It didnt changed anything. Is that right?

Thanks you

I had .htaccess in 755.
Same result with 777:

Options:
* WordPress redirect
* Mixed content fixer
SERVER: apache
SSL is enabled for this site
** Detecting configuration **
plugin version: 2.5.26
Already on SSL, start detecting configuration
SSL type: SERVER-HTTPS-ON
** Configuring SSL **
testing htaccess rules...
test page url, enter in browser to check manually: https://www.example.cz/TEMP/wp-content/plugins/really-simple-ssl/testssl/serverhttpson/ssl-test-page.html
htaccess rules test failed with error: Too many redirects
checking if .htaccess can or should be edited...
.htaccess does not contain default Really Simple SSL redirect
retrieving redirect rules
converting siteurl and homeurl to https

I thought too, because one plugin noticed me that .htaccess is not writable, but .htaccess is 644 (and WP Fastest cache uses it). Does WPS need to write to .htaccess?

Except for WP fastest cache code there is only:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /TEMP/
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /TEMP/index.php [L]
</IfModule>
# END WordPress

There is one more difference from localhost, it is SSL. But 404 link is right it has https:// .

OK, I found out one thing: Everything works fine on localhost, but not on live server.

For to be sure… I reinstalled whole site with fresh localhost backup (Duplicator) and I didnt install (Wordfence, WP super cache, Autoptimize), but 404 error remain.
Only one diffrence I have from localhost is RewriteBase /TEMP/ (site is now hidden for testing in ‘TEMP’ folder – works without any problem except for WPML x WPS).