1

My site was running well last summer. But today when I tried to make updates in the wp-admin section, I got lots of 403 errors on all PHP files: load-styles, load-scripts, edit.php, media-new.php, etc... The interesting thing is that the front-end of my site has no problems.

Screenshot:

403 errors in network tab

  1. I've read a few articles suggesting I disable plugins. I tried it, but it does not fix anything.
  2. Then I tried deleting my .htaccess file, and this does fix the wp-admin section, but it breaks the front-end, and now I get 403 errors on the homepage! It's like I can only get one or the other. After about 5 minutes, Wordpress automatically creates a new .htaccess file, and we're back to square one.

What permissions and settings should I set on .htaccess so I can run both my front-end and wp-admin sections without 403 Forbidden errors? This is what it looks like now:

<FilesMatch ".(py|exe|php)$">
 Order allow,deny
 Deny from all
</FilesMatch>
<FilesMatch "^(about.php|radio.php|index.php|content.php|lock360.php|admin.php|wp-login.php)$">
 Order allow,deny
 Allow from all
</FilesMatch>
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
4
  • Is that the exact .htaccess file you have (that is "automatically created")? Are there no # BEGIN WordPress comment markers etc.?
    – MrWhite
    Jun 17, 2021 at 20:55
  • @MrWhite Yep, that's the whole thing! All 16 lines of it. I just double-checked, and there are no # BEGIN comments anywhere.
    – M -
    Jun 17, 2021 at 20:58
  • Try removing both <FilesMatch> blocks and wrap the <IfModule> block in # BEGIN WordPress and # END WordPress comment markers. What happens? Are these sections regenerated? And specifically, where in the .htaccess file are these generated (now that the # BEGIN/END WordPress comment markers are in place)?
    – MrWhite
    Jun 17, 2021 at 21:20
  • how did you fix, this is a malware! Sep 12, 2021 at 23:41

2 Answers 2

2

You appear to be denying access to PHP files, which would explain why you are denied access to PHP files:

<FilesMatch ".(py|exe|php)$">
 Order allow,deny
 Deny from all
</FilesMatch>

What is the purpose of this?

6
  • I didn't create the .htaccess file. It was automatically generated, I presume by some Wordpress script?
    – M -
    Jun 17, 2021 at 19:02
  • WordPress only creates the IfModule section. If you didn’t write the first section then something else is, but not WordPress. You should speak to your host. Jun 17, 2021 at 19:03
  • Ah, I see. So ideally, that top line should only read <FilesMatch ".(py|exe)$"> without the php?
    – M -
    Jun 17, 2021 at 19:05
  • I mean, I don’t really see the purpose of any of it, but yes, php files need to be accessible for WordPress to work. Jun 17, 2021 at 19:07
  • 1
    @Marquizzo If you remove php from the first directive then the 2nd <FilesMatch> container is redundant. The 2nd <FilesMatch> container is attempting to override the first "generalised" block and allow access to specific .php files. eg. admin.php and wp-login.php etc. Without this your main site would not work. However, this is not sufficient (as you have demonstrated). If this is auto-generated then it would seem you may have a half-baked security plugin that should probably be removed? (This is also using deprecated Apache 2.2 directives; you are probably on Apache 2.4?)
    – MrWhite
    Jun 17, 2021 at 21:15
0

This is caused by webshell, your wordpress must have some of these lock360.php or radio.php files, it does this so that if someone else sends a shell or some malicious script it doesn't run and only its shell is executed, probably your website is being sold in some dark spam market

recommend you reinstall your wordpress and scan your theme and etc. Also check your google results your site may be being cloaked, check site:yoursite.com

1
  • Another thing, it's not wordpress that creates the htaccess file, there must be some file running in the background overwriting the htaccess, I recommend you look at your index.php too, there may be malicious code in it Sep 15, 2021 at 12:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.