Issues with Multisite installation and 403 error for REST API request

Question

I have set up WP as multisite installation with subdomains. The dashboard for both the site network and each site is working fine, except for the error I get using Block Editor on my parent site.

So I have wyamazaki.fi as my main domain, and want to create two websites, one for blog, another for company website using multisite. I have wildcard subdomain set up in cPanel, and redirect seems to be working.

Whenever I create/edit page on my main site, the Block editor fails with error saying "Updating Failed". I checked the console on Chrome, and it seems like all the API requests are resulting in 403 error. (404 was when I tested different RewriteBase in .htaccess)

I have checked my .htaccess and they seem to be okay to my eyes.

#HTTPS-ohjaus: wyamazaki.fi
RewriteEngine On 
RewriteCond %{HTTP_HOST} ^wyamazaki.fi [NC,OR]
RewriteCond %{HTTP_HOST} ^www.wyamazaki.fi [NC]
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
#HTTPS-ohjaus loppuu
#HTTPS-ohjaus: *.wyamazaki.fi
RewriteEngine On 
RewriteCond %{HTTP_HOST} ^*.wyamazaki.fi [NC,OR]
RewriteCond %{HTTP_HOST} ^www.*.wyamazaki.fi [NC]
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
#HTTPS-ohjaus loppuu
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]

# add a trailing slash to /wp-admin
RewriteRule ^([_0-9a-zA-Z-]+/)?wp-admin$ $1wp-admin/ [R=301,L]

RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule ^([_0-9a-zA-Z-]+/)?(wp-(content|admin|includes).*) $2 [L]
RewriteRule ^([_0-9a-zA-Z-]+/)?(.*\.php)$ $2 [L]
RewriteRule . index.php [L]

The strange thing is it works just fine for the subdomain child sites (translation.wyamazaki.fi), but the parent site (wyamazaki.fi) gives me 403 whatever I do with page. I'm suspecting issues with server side security, but can't be certain.

I could use Classic Editor without the issues above, but it feels like it's ignoring the problem in the long run (block editor doesn't seem to go away in near future, so...) .

Another option I have in mind is to use two subdomains and set redirect to one of them to show it for wyamazaki.fi access, but not sure how (I'm still learning apache and php).

Any help is appreciated!

Answer 1

I had a similar issue that was caused by the Cloudflare proxy.

To solve it, I switched off SSL within cloudflare, installed LetsEncrypt on the server and then changed Cloudflare's SSL setting to "Full" which then made everything work for me first time.

Answer 2

If you're using WordPress Multisite in subdomain mode, here's the recommended .htaccess file WordPress section (see the WordPress support page):

RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]

# add a trailing slash to /wp-admin
RewriteRule ^wp-admin$ wp-admin/ [R=301,L]

RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule ^(wp-(content|admin|includes).*) $1 [L]
RewriteRule ^(.*\.php)$ $1 [L]
RewriteRule . index.php [L]

(Assuming that you started with WordPress version 3.5 or higher. For WP 3.4 and lower, see the support page linked above.)

Your .htaccess file looks like it's actually using code from the subfolder Multisite installation.