0

I have a wordpress web site with only a private pages (can only be viewed by logged users)

I use the below code in my theme functions.php to be redirected to login page each time a put the page URL on the browser.

add_action( 'wp', 'redirect_private_page_to_login' );
function redirect_private_page_to_login(){
    $queried_object = get_queried_object();
    if (
        isset( $queried_object->post_status ) &&
        'publish' === $queried_object->post_status &&
        ! is_user_logged_in()
    ) {
        wp_safe_redirect( wp_login_url( get_permalink( $queried_object->ID ) ) );
        exit;
    }
}

When i put my page URL on the browser

example : https://website.com/page1 I should be redirected to :

https://website.com/wp-login.php?redirect_to=https%3A%2F%2Fwebsite.com%2Fpage1%2F

It works but Sometimes i'm redirected to https://website.com/index.php . It happen frequently with Edge and safari browsers (that is my issue).

I think something is wrong in the redirection of the pages. It probably come from my .htaccess . I want to share it with you and hope someone can help me with this.

Note: I use SecuPress as security plugin. i have also a subdomain that why you will find test.website.com in the .htaccess

HTACCESS

# BEGIN SecuPress no_x_powered_by
<IfModule mod_headers.c>
    Header unset X-Powered-By
</IfModule>
# END SecuPress
# BEGIN SecuPress readme_discloses
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^(.*/)?(readme|changelog|debug)\.(txt|md|html|log)$ - [R=404,L,NC]
</IfModule>
# END SecuPress
# BEGIN SecuPress wp_version
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^readme\.html$ - [R=404,L,NC]
</IfModule>
# END SecuPress
# BEGIN SecuPress bad_url_access
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteCond %{REQUEST_URI} !wp-includes/js/tinymce/wp-tinymce\.php$
    RewriteRule ^(php\.ini|wp-config\.php|wp-includes/.+\.php|wp-admin/(admin-functions|install|menu-header|setup-config|([^/]+/)?menu|upgrade-functions|includes/.+)\.php)$ [R=404,L,NC]
</IfModule>
# END SecuPress
# BEGIN SecuPress directory_listing
<IfModule mod_autoindex.c>
    Options -Indexes
</IfModule>
# END SecuPress
# BEGIN SecuPress php_disclosure
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} \=PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC]
    RewriteRule .* - [F]
</IfModule>
# END SecuPress
# BEGIN SecuPress bad_file_extensions
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^wp-content/uploads/.*\.(\.9|73i87a|386|aaa|abc|aepl|aru|atm|aut|bat|bhx|bin|bkd|blf|bll|bmw|boo|bps|bqf|breaking_bad|btc|buk|bup|bxz|ccc|ce0|ceo|cfxxe|chm|cih|cla|cmd|com|coverton|cpl|crinf|crjoker|crypt|crypted|cryptolocker|cryptowall|ctbl|cxq|cyw|czvxce|darkness|dbd|delf|dev|dlb|dli|dll|dllx|dom|drv|dx|dxz|dyv|dyz|ecc|enciphered|encrypt|encrypted|enigma|exe1|exe_renamed|exx|ezt|ezz|fag|fjl|fnr|fuj|fun|good|gzquar|ha3|hlp|hlw|hsq|hts|iva|iws|jar|kcd|kernel_complete|kernel_pid|kernel_time|keybtc@inbox_com|kimcilware|kkk|kraken|lechiffre|let|lik|lkh|lnk|locked|locky|lok|lol!|lpaq5|magic|mfu|micro|mjg|mjz|nls|oar|ocx|osa|ozd|p5tkjw|pcx|pdcr|pgm|php|php2|php3|pid|pif|plc|poar2w|pr|pzdc|qit|qrn|r5a|rdm|rhk|rna|rokku|rrk|rsc_tmp|s7p|scr|scr|shs|ska|smm|smtmp|sop|spam|ssy|surprise|sys|tko|tps|tsa|tti|ttt|txs|upa|uzy|vb|vba|vbe|vbs|vbx|vexe|vxd|vzr|wlpginstall|wmf|ws|wsc|wsf|wsh|wss|xdu|xir|xlm|xlv|xnt|xnxx|xtbl|xxx|xyz|zix|zvz|zzz)$ - [R=404,L,NC]
</IfModule>
# END SecuPress
# BEGIN SecuPress hotlink
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteCond %{REQUEST_FILENAME} \.(jpg|jpeg|png|gif)$ [NC]
</IfModule>
# END SecuPress
# BEGIN WordPress
# The directives (lines) between `BEGIN WordPress` and `END WordPress` are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
# Protect wp-config.php
<files wp-config.php>
order allow,deny
deny from all
</files>
# Redirection to HTTPS
RewriteCond     %{SERVER_PORT} ^80$
RewriteRule     ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]
RewriteCond %{HTTP_REFERER} !^http://test.website.com/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^http://test.website.com$      [NC]
RewriteCond %{HTTP_REFERER} !^http://website.com/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^http://website.com$      [NC]
RewriteCond %{HTTP_REFERER} !^http://www.test.website.com/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^http://www.test.website.com$      [NC]
RewriteCond %{HTTP_REFERER} !^http://www.website.com/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^http://www.website.com$      [NC]
RewriteCond %{HTTP_REFERER} !^https://test.website.com/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^https://test.website.com$      [NC]
RewriteCond %{HTTP_REFERER} !^https://website.com/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^https://website.com$      [NC]
RewriteCond %{HTTP_REFERER} !^https://www.test.website.com/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^https://www.test.website.com$      [NC]
RewriteCond %{HTTP_REFERER} !^https://www.website.com/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^https://www.website.com$      [NC]
RewriteRule .*\.(jpg|jpeg|gif|png|bmp)$ - [F,NC]
# BEGIN MINIORANGE MEDIA RESTRICTION
# The directives (lines) between `BEGIN MINIORANGE MEDIA RESTRICTION` and `END MINIORANGE MEDIA RESTRICTION` are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
RewriteCond %{REQUEST_FILENAME} ^.*(png|jpg|pdf|doc|docx|xlsx|xls|mp4|ppt|pptx|mov|mpeg|avi|m4v|svg|wmv|bmp)$ [OR]
RewriteCond %{REQUEST_URI} protectedfiles 
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in.*$ [NC]
RewriteRule . - [R=403,L]
# END MINIORANGE MEDIA RESTRICTION
# BEGIN cPanel-generated php ini directives, do not edit
# Manual editing of this file may result in unexpected behavior.
# To make changes to this file, use the cPanel MultiPHP INI Editor (Home >> Software >> MultiPHP INI Editor)
# For more information, read our documentation (https://go.cpanel.net/EA4ModifyINI)
<IfModule php7_module>
   php_value upload_max_filesize 25M
   php_value post_max_size 128M
   php_flag display_errors Off
   php_value max_execution_time 2000
   php_value max_input_time 600
   php_value max_input_vars 4000
   php_value memory_limit 512M
   php_value session.gc_maxlifetime 1440
   php_value session.save_path "/var/cpanel/php/sessions/ea-php74"
   php_flag zlib.output_compression Off
</IfModule>
<IfModule lsapi_module>
   php_value upload_max_filesize 25M
   php_value post_max_size 128M
   php_flag display_errors Off
   php_value max_execution_time 2000
   php_value max_input_time 600
   php_value max_input_vars 4000
   php_value memory_limit 512M
   php_value session.gc_maxlifetime 1440
   php_value session.save_path "/var/cpanel/php/sessions/ea-php74"
   php_flag zlib.output_compression Off
</IfModule>
# END cPanel-generated php ini directives, do not edit

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php74” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php74 .php .php7 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit

Thanks you in advance for your help.

Regards.

Improve this question

1 Answer 1

Reset to default
1 
# Redirection to HTTPS
RewriteCond     %{SERVER_PORT} ^80$
RewriteRule     ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

This rule is in the wrong place. It needs to go before the # BEGIN WordPress comment marker. ie. Before the WordPress front-controller.

Currently, this will result in a redirect to /index.php if requesting HTTP.

# BEGIN SecuPress hotlink
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteCond %{REQUEST_FILENAME} \.(jpg|jpeg|png|gif)$ [NC]
</IfModule>
# END SecuPress

And this block is incomplete/wrong. Unless you know the missing directives, this block must be deleted.

Fortunately, it's "only" making the next RewriteRule (in the WordPress code block) superfluous, but it could potentially break your site.

Improve this answer
1
  • It works thanks. any idea to make this htaccess more secure?
    – Samuel
    Nov 11, 2021 at 13:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.