Tell me more ×
WordPress Answers is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

Whenever I try to update my Permalink settings or use the Theme Editor to modify some file, I am redirected to a 404 page. This also happens when I update the All-In-One SEO Pack plugin's settings. This does not happen in the case of other settings pages or plugin options. I have tried re-uploading WordPress from a fresh local copy, and have also tried deactivating all plugins. My hosting provider has given up, blaming WordPress. What is wrong here?

Some things I suspect:

  • My .htaccess file. I am not using anything extra, other than turning off mod_security.
  • Suhosin. After a recent security breach, my provider recompiled PHP with Suhosin. I have disabled it currently, which solved a lot of compatibility problems with other plugins.
  • File/folder permissions.
  • PHP memory issues, maybe?
share|improve this question
1  
Are you using a commercial theme or something homemade? I've seen a couple of themes that hook into awkward places in the admin area leaving broken pages and unintended redirects. A site I looked at this morning was redirecting users to a wp_die message when they tried to edit links. – goldenapples Nov 23 '10 at 6:22
I am using a commercial theme from Smashing Magazine. Fact is, I've been using it for almost 2 years now, and have never had these issues. Recently, the shared server where my website was hosted was breached and they had to reinstall their stuff, and only after that am I experiencing such problems. So I'm quite sure that the theme is not the culprit! – GPX Nov 23 '10 at 7:48

1 Answer

up vote 1 down vote

Double check mod_security and ask hosting to check its logs. It can be configured to ignore .htaccess and obscure 404 in admin seems like something it does at times.

I had to ask my hosting to explicitly whitelist WP core files some files in mod_security on their end for everything to work properly.

share|improve this answer
I had figured out that it would come to this. What are the implications of excluding core files from the mod_security rules? Wouldn't it leave my website open to hackers again? – GPX Nov 23 '10 at 14:58
I am no expert on security. From my understanding mod_security is merely additional firewall layer. As any firewall it must be configured so that stuff that should work does work. As any firewall it is neither single or critically important security measure. – Rarst♦ Nov 23 '10 at 18:57
Good enough, then. Can you tell me what all files I should ask them to whitelist? Or can I just ask them to whitelist wp-admin/*? – GPX Nov 24 '10 at 4:58
Depends on your hosting's specific mod_security config. It's not really mod_security breaks everything. It's mod_security breaks specific file, doing specific thing because of specific rule. My hosting declined to whitelist all of WP core so we went through logs and whitelisted files that triggered errors one by one. – Rarst♦ Nov 24 '10 at 6:22
Well my hosting company said they won't modify the rules. Goodbye, crappy hosting company. I will be migrating my domain soon. Thanks for the help! – GPX Nov 25 '10 at 12:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.