WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My wordpress blog has encountered this issue about a week ago. Before that nothing was wrong with it. I got suspicious on web host provider, but they said many times that rewrite engine is on and it works properly.

I ported all source code to my localhost and I have the same issue again. I cannot go to admin section, blogs, etc.

I've read many posts here, but unfortunately gained no success!

What has happened to my blog?

<IfModule mod_rewrite.c>
 RewriteEngine On


RewriteEngine on RewriteRule ^/vorood/?$ /wp-login.php [QSA,L] Order allow,deny Deny from all Order allow,deny Deny from all Order allow,deny Deny from all Order allow,deny Deny from all Order allow,deny Deny from all

# Rules to disable directory browsing
Options -Indexes

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Rules to protect wp-includes
    RewriteRule ^wp-admin/includes/ - [F]
    RewriteRule !^wp-includes/ - [S=3]
    RewriteCond %{SCRIPT_FILENAME} !^(.*)wp-includes/ms-files.php
    RewriteRule ^wp-includes/[^/]+\.php$ - [F]
    RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F]
    RewriteRule ^wp-includes/theme-compat/ - [F]

    # Rules to prevent php execution in uploads
    RewriteRule ^(.*)/uploads/(.*).php(.?) - [F]

    # Rules to block unneeded HTTP methods
    RewriteRule ^(.*)$ - [F]

    # Rules to block suspicious URIs
    RewriteCond %{QUERY_STRING} \.\.\/ [NC,OR]
    RewriteCond %{QUERY_STRING} ^.*\.(bash|git|hg|log|svn|swp|cvs) [NC,OR]
    RewriteCond %{QUERY_STRING} etc/passwd [NC,OR]
    RewriteCond %{QUERY_STRING} boot\.ini [NC,OR]
    RewriteCond %{QUERY_STRING} ftp\:  [NC,OR]
    RewriteCond %{QUERY_STRING} http\:  [NC,OR]
    RewriteCond %{QUERY_STRING} https\:  [NC,OR]
    RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|%3D) [NC,OR]
    RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]
    RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>|ê|"|;|\?|\*|=$).* [NC,OR]
    RewriteCond %{QUERY_STRING} ^.*(&#x22;|&#x27;|&#x3C;|&#x3E;|&#x5C;|&#x7B;|&#x7C;).* [NC,OR]
    RewriteCond %{QUERY_STRING} ^.*(%24&x).* [NC,OR]
    RewriteCond %{QUERY_STRING} ^.*(127\.0).* [NC,OR]
    RewriteCond %{QUERY_STRING} ^.*(globals|encode|localhost|loopback).* [NC,OR]
    RewriteCond %{QUERY_STRING} ^.*(request|concat|insert|union|declare).* [NC]
    RewriteCond %{QUERY_STRING} !^loggedout=true
    RewriteCond %{QUERY_STRING} !^action=rp
    RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in_.*$
    RewriteCond %{HTTP_REFERER} !^http://maps\.googleapis\.com(.*)$
    RewriteRule ^(.*)$ - [F]

    # Rules to help reduce spam
    RewriteCond %{REQUEST_METHOD} POST
    RewriteCond %{REQUEST_URI} ^(.*)wp-comments-post\.php*
    RewriteCond %{HTTP_REFERER} !^(.*)mywebsite.com.* 
    RewriteCond %{HTTP_REFERER} !^http://jetpack\.wordpress\.com/jetpack-comment/ [OR]
    RewriteCond %{HTTP_USER_AGENT} ^$
    RewriteRule ^(.*)$ - [F]

Let's consider that rewrite engine is not enabled in the host provider. I got the same result in my localhost. In localhost I have several other projects that use rewrite rules extensively. In wordpress I get 404 Not Found

share|improve this question
You must be sure that your hosting provider has the revrite engine enabled. – NETCreator Hosting - WebDesign Jun 5 '14 at 13:01
Place RewriteEngine On outside the IfModule condition. If you get a 500 Internal Server Error, mod_rewrite is not enabled. – TheDeadMedic Jun 5 '14 at 13:02
You can also try <?php print_r(apache_get_modules()); ?> and check if there exists mod_rewrite. – NETCreator Hosting - WebDesign Jun 5 '14 at 13:05
@NETCreator Worth mentioning that won't work if PHP is running as CGI. – TheDeadMedic Jun 5 '14 at 13:16
Can you show us the whole rewrite rules in .htaccess ? – kraftner Jun 5 '14 at 13:40
up vote 0 down vote accepted

I emptied both permalink and itsec_hide_backend fields in options table through phpMyAdmin. Then I removed everything from .htaccess and then logged into my blog's dashboard by typing /wp-login.php then I set permalink through Settings->Permalink to /%postname%/.

Voila! Everything works fine now. ;-)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.