3

I'm not sure if this is specific to my site or not, but if anyone knows how to override this behavior, that would be most appreciated! I have WordPress installed in the root directory of my server. There is also an unrelated sub-directory we'll call 'restricted-dir'. I have added an .htaccess file inside that directory with the following code:

Deny from all

Without that command, if a user visits www.my-domain.com/restricted-dir/ it would list all contents. I would like the user to receive the server's typical 403 Forbidden message, but instead WordPress kicks in and directs the user to my 404 page on my website.

Is there anything I can do to make the 403 page show up instead of the 404 page along with my entire WordPress install?

Improve this question
3
  • Are you using apache 2.2 or 2.4? For 2.2, your try should work imho, for 2.4, you should use Require all denied, see also the upgrade guide.
    – janh
    Oct 30, 2017 at 18:39
  • It's only 2.2 so I would have thought so too, unless something else is overriding it. I had hoped it was a WP thing that could be overwritten.
    – Erica
    Oct 30, 2017 at 18:48
  • Changing my WordPress theme did not change the results. I wanted to check since it had custom 404 settings.
    – Erica
    Oct 30, 2017 at 18:49

2 Answers 2

Reset to default
0

Thinking on it for a minute, I suppose it has something to do with the rewrite rules from the WP .htacces is kicking in and rewriting the request to WP. It doesn't totally make sense to me, because WP's rewrite rules actually ignore directories, and I cannot reproduce it with a quick test, but there might be other factors at play in your environment.

Adding 

RewriteEngine On
RewriteRule ^restricted-dir - [F,L]

in the WP .htaccess before the WordPress Rewrite Rules should have the same result, denying access to restricted-dir with a 403 response.

Improve this answer
4
  • Thanks, perhaps there is something else, because this didn't work either :( If a directory doesn't exist WP assumes it is a permalink attempt. For some reason 403 restrictions seem to be the same to WP as if it didn't exist.
    – Erica
    Nov 3, 2017 at 3:04
  • Did you have that before the WordPress block in your .htaccess? I've tested it on my system and it worked just fine. Generally yes, WP has no way of telling whether /someThingUnknown/ was "supposed" to be a directoy or a permalink, but the RewriteRule should make sure that WP doesn't even see the request, that's why it is important that it's before the WP stuff. Try putting it at the top of the .htaccess if it's not there yet.
    – janh
    Nov 3, 2017 at 6:39
  • It is. Perhaps it's time to contact my server's support to see why this is... multiple people have made it work on theirs but it doesn't work for me. Thanks for your help
    – Erica
    Nov 3, 2017 at 12:41
  • 1
    FYI, you don't need to add L after F. Apache returns the response immediately when using F; the L flag is implied.
    – BadHorsie
    Jun 8, 2020 at 14:47
0

This question is old but in case anyone else comes across with the same problem, I found the answer in this ticket:

https://wordpress.stackexchange.com/a/20274/31889

(For me solution #3 was the ticket, but I also have the first two in place so maybe it was a combination.)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.