I was developing a WordPress site locally, all was going well. I set up a preview site on a VPS I control. The account has the final domain, I added a subdomain and set the site up on that subdomain.

At this point, most things work. I can navigate the front of the site. In the backend, things get screwy. Several actions in the admin force a redirect to the front page of the site. For example, if I try to save permalinks with anything other than "Plain". No matter the permalinks settings, if I go to Appearance->Menus and try to save, it redirects to the home page. If I try to update a plugin using pretty updates (via ajax), it says it errored and the output produced is the markup for the front page.

This wasn't (and still isn't) a problem on the local copy. I've disabled all plugins and swapped the theme to 2017. No dice. WP-CLI find/replace on the database, all went square. Last caveat is that I keep the core files in a subdirectory (wp), which means the index.php in my site root does this:

require( dirname( __FILE__ ) . '/wp/wp-blog-header.php' );

And in wp-config.php I have to explicitly define:

define('WP_CONTENT_DIR', dirname(__FILE__).'/wp-content'); define('WP_CONTENT_URL', 'http://preview.mysite.com'.'/wp-content');

This keeps it from looking for wp-content in the same directory as the core files. I've used this setup many many times with no issues. I have one other WordPress site on this VPS using the same setup, but no subdomain, that works fine. I've scrapped the whole thing and started up to no avail.

Anyone ever seen anything like this?


 * The base configuration for WordPress
 * The wp-config.php creation script uses this file during the
 * installation. You don't have to use the web site, you can
 * copy this file to "wp-config.php" and fill in the values.
 * This file contains the following configurations:
 * * MySQL settings
 * * Secret keys
 * * Database table prefix
 * @link https://codex.wordpress.org/Editing_wp-config.php
 * @package WordPress

// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define('DB_NAME', 'databasehere');

/** MySQL database username */
define('DB_USER', 'userhere');

/** MySQL database password */
define('DB_PASSWORD', 'passwordhere');

/** MySQL hostname */
define('DB_HOST', 'localhost');

/** Database Charset to use in creating database tables. */
define('DB_CHARSET', 'utf8');

/** The Database Collate type. Don't change this if in doubt. */
define('DB_COLLATE', '');

 * Authentication Unique Keys and Salts.
 * Change these to different unique phrases!
 * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}
 * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again.
 * @since 2.6.0

// salts defined properly here


 * WordPress Database Table prefix.
 * You can have multiple installations in one database if you give each
 * a unique prefix. Only numbers, letters, and underscores please!
$table_prefix  = 'wp_';

 * For developers: WordPress debugging mode.
 * Change this to true to enable the display of notices during development.
 * It is strongly recommended that plugin and theme developers use WP_DEBUG
 * in their development environments.

 * For information on other constants that can be used for debugging,
 * visit the Codex.
 * @link https://codex.wordpress.org/Debugging_in_WordPress
define('WP_DEBUG', false);
define('WP_CONTENT_DIR', dirname(__FILE__).'/wp-content');

        define('WP_CONTENT_URL', 'http://preview.url.com'.'/wp-content');

define( 'WP_HOME', 'http://' . $_SERVER['SERVER_NAME'] );
define( 'WP_SITEURL', WP_HOME . '/wp' );
/* That's all, stop editing! Happy blogging. */

/** Absolute path to the WordPress directory. */
if ( !defined('ABSPATH') )
    define('ABSPATH', dirname(__FILE__) . '/');

/** Sets up WordPress vars and included files. */
require_once(ABSPATH . 'wp-settings.php');

And the directory structure:

- preview
  - .git
  - .gitignore
  - .htaccess
  - composer.json
  - composer.lock
  - index.php
  - readme.md
  - vendor/
  - wp/
    - license.txt
    - readme.html
    - wp-activate.php
    - wp-admin
    - wp-includes
    - and all the other usual root files
  - wp-config.php
  - wp-content/ <-- has what you would expect: plugins, themes, uploads...

Problems were due to the OWASP ModSecurity rules enabled on the server and causing false positives. Disabled, solved. Not a new problem. Also answered here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.