On a Wordpress site I have a password protected directory at the same level as Wordpress containing static content. Wordpress is installed in the root of the site:
https://example.com/ - Wordpress site
After authenticating, the browser can download most of the files in there but there are some that are causing a 404 response. E.g.
Update 1: If I put the *.LICENSE.txt file in a non password protected dir I get the same result, so it's probably not related to that.
Update 2: Installed the Redirection plugin. It logs a 404 for that file, so it evidently is Wordpress related, rather than http server related.
Update 3: The 404 response is actually a secondary effect from a 403 reponse where the 404 is actually for the ErrorDocument. Specifying the 403 error document (in .htaccess) unmasks the 403 and the Redirect plugin no longer logs it.
Update 4: I have also tried this on a "lean" install of Wordpress that has no plugins, with the file in a non-protected subdir. Same 403 error.
How do I debug this?