WordPress Site Health 403

tecreasey

Hi,

Has anyone experienced any issues with 403 errors on WordPress?

A client is getting 403 errors editing certain pages, which I haven't been able to replicate. But now I am getting errors trying to access Site Health.

I have enabled debug to see if anything is returned, but I cannot see much.

Nothing has changed with file/folder permissions, so I am unsure why this has started happening.

I just wondered if anyone else had experienced anything similar.

Adam

tecreasey

Is mod_security enabled? If so, this is the most likely cause.

DracoBlue

Adam, my site health page also doesn't work when mod_security is enabled.

Adam

The default OWASP rules are a bit aggressive for WordPress, some customisation is often required.

Andreas

@tecreasey What webserver are you running?
On a test server I have, using OLS, gave me some errors, but on apache its fine.

Rich

Andreas Likewise with only OLS, I've not seen issues with accessing the health page. Been checking a fair bit on one site recently. Tested another site and it's fine.

403 issues I've experienced so far was also down to permalinks and .htaccess rules. Refreshing the permalinks, or giving OLS a graceful reboot usually cleared it out.

twest

I posted custom exclusions you can add to your mod security config that fixes that, and more. Look up the old thread.

I created so many exclusions that I finally gave up. ModSecurity is totally useless for a WordPress host, after excluding everything it breaks - what's left? An engine full of rules followed by a list of exclusions that turn off all the rules.

tecreasey

twest if you're having to create a lot of rules if almost feels like it defeats the objective in the first place.

I have disabled it for now until I can review it and the rules I would need.

josedieguez

we haven't fully tested modsecurity with enhance yet, but after hundreds, thousands of websites and many servers, we also ended up with a considerable list of exclusions lol.

I do recommend to keep modsecurity on, and start growin a list of rules you know are giving false positives.