Fix 403 error on WordPress multisite network using subdomains

Question

I've a WordPress installation that I've transformed into a multisite network. I'm using cPanel and I've followed all the instructions to configure the WordPress installation. I've set up the subdomains mode, so for every new website I need to create a subdomain using cPanel of my shared hosting provider.

The problem is that I get a 403 error every time I try to access to a subdomain website. How I can fix this and is the .htaccess code correct?

NB: every subdomain has it's own directory on the server when it's created, so for example, if in the cPanel I set the mysite.example.com as a subdomain, the relative directory will be created in the root of the server, with the name of mysite.example.com. I've read that the subdomains must point to the main WordPress installation directory. I've also setup the wildcard, but without success.

Here is the .htaccess code.

# BEGIN Custom
<IfModule mod_rewrite.c>
Options All -Indexes
Options FollowSymLinks
RewriteEngine On
RewriteBase /
RewriteCond %{HTTPS} !on
RewriteRule (.*) https://%{HTTP_HOST}/$1 [NC,R=301,L]
</IfModule>

<IfModule mod_headers.c>
#Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header set X-Content-Type-Options nosniff
Header set X-XSS-Protection "1; mode=block"
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
Header unset X-Powered-By
Header unset X-Pingback
Header unset SERVER
</IfModule>

<FilesMatch "(^\.|wp-config(-sample)*\.php)">
Order Deny,Allow
Deny from all
</FilesMatch>

# END Custom


# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]

# add a trailing slash to /wp-admin
RewriteRule ^wp-admin$ wp-admin/ [R=301,L]

RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule ^(wp-(content|admin|includes).*) $1 [L]
RewriteRule ^(.*\.php)$ $1 [L]
RewriteRule . index.php [L]
</IfModule>

# END WordPress

wp-config.php code

// HTTPS
if( strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false) $_SERVER['HTTPS'] = 'on';

define('MULTISITE', true);
define('SUBDOMAIN_INSTALL', true);
define('DOMAIN_CURRENT_SITE', 'mysite.com');
define('PATH_CURRENT_SITE', '/');
define('SITE_ID_CURRENT_SITE', 1);
define('BLOG_ID_CURRENT_SITE', 1); 

Answer 1

every subdomain has it's own directory on the server when it's created, so for example, if in the cPanel I set the mysite.example.com as a subdomain, the relative directory will be created in the root of the server, with the name of mysite.example.com. I've read that the subdomains must point to the main wordpress installation directory.

You seem to be answering your own question. Yes, the subdomains all need to point to the main WordPress installation. This is how multisite works, all requests are handled by the same WordPress installation, by the same front-controller (mod_rewrite directives in the root .htaccess file).

When creating a subdomain in cPanel you should have full control over the subdomains "document root". (It even allows you to point it to a directory that is entirely outside of the main domains document root if you wanted to.)

By creating a subdomain that points to a subdirectory, you are setting the DocumentRoot of that subdomain to that subdirectory. It won't necessarily be able to access files in the directory above (the main domains document root).

When you access the subdomain, which probably does not have an index document (and directory listings are disabled) then you will get a 403 Forbidden response by default.