0

On a Wordpress site I have a password protected directory at the same level as Wordpress containing static content. Wordpress is installed in the root of the site:

https://example.com/ - Wordpress site

https://example.com/mydir/* - password protected files e.g. https://example.com/mydir/somefile.txt

After authenticating, the browser can download most of the files in there but there are some that are causing a 404 response. E.g.

https://example.com/mydir/foo.txt - OK

https://example.com/mydir/foo.LICENSE.txt - 404

Update 1: If I put the *.LICENSE.txt file in a non password protected dir I get the same result, so it's probably not related to that.

Update 2: Installed the Redirection plugin. It logs a 404 for that file, so it evidently is Wordpress related, rather than http server related.

Update 3: The 404 response is actually a secondary effect from a 403 reponse where the 404 is actually for the ErrorDocument. Specifying the 403 error document (in .htaccess) unmasks the 403 and the Redirect plugin no longer logs it.

Update 4: I have also tried this on a "lean" install of Wordpress that has no plugins, with the file in a non-protected subdir. Same 403 error.

How do I debug this?

6
  • Well, did those files like foo.LICENSE.txt really exist in your password-protected directory? If yes, then WordPress wouldn't 404 them since the path exists. If it's a virtual path, then yes maybe, WordPress would 404 the request.
    – Sally CJ
    Mar 3, 2023 at 2:42
  • How are you handling the authentication for the password-protected files? Is WordPress managing it, or .htaccess, or a custom script?
    – Pat J
    Mar 3, 2023 at 3:20
  • @SallyCJ Yes, the files exist. The issue appears to be caused by the .LICENSE.txt suffix as both *.txt and *.LICENSE are working.
    – glennr
    Mar 3, 2023 at 4:31
  • @PatJ Authentication is via .htaccess/.htpasswd and is managed by cPanel. I'm beginning to think it's not a Wordpress issue.
    – glennr
    Mar 3, 2023 at 4:34
  • 1
    @glennr how could that be possible, unless both the files truly exist in that folder? And if they do, it's even weirder, since - as I said, WordPress wouldn't 404 a file path that exists. Can you share the contents in your .htaccess file? (And a screenshot of the Redirection plugin's logs) (just "hide" sensitive details)
    – Sally CJ
    Mar 3, 2023 at 14:23

1 Answer 1

1

The issue was caused by some global cPanel Wordpress configuration, to which I don't have access, that blocks access to "sensitive" files, evidently based on the file name.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.