0

I am working on a site that is consistently throwing a 403 error when I try to access the dashboard.

I have tried resetting the .htacess file, resetting the permissions on directories to 755 and on files to 644, checked the wp-config for any issues or anomalies, spot checked a few files via FTP (functions.php in themes, looked for strange nameed files in plugins, themes, folders etc.) for any signs of malicious code, disabled all plugins, disabled all themes except for a default 2019 theme.

I also used a function in a theme to create a brand new admin user and logged in with that and still get the "Sorry, you are not allowed to access this page" message

The only thing that is available is the Gravity Forms backend... which sticks out as very strange to me...

I've also observed that only the homepage loads/is available, attempting to navigate to any page in the nav leads to a 404... which makes me think it's almost certainly been compromised... I just haven't been to locate the source...

I was also looking into running a wordfence scan via the CLI but it looks like that isn't possible plus the plugin isn't installed/activated on the site anyway...

Any suggestions on how to resolve this?

Improve this question

1 Answer 1

Reset to default
0

Seems like you tried a lot of things, sorry you're stuck like this. You didn't mention anything about the database, though - have you also tried importing a whole new DB? An usermeta issue might explain this.

I'd try deleting the database (while backing it up first) and renaming the plugin folder to something like "_plugins" to make sure WP won't see them.

If it starts the setup process, great - you'll likely have the wp-admin. From there, rename the plugin folder and start troubleshooting the database. If it doesn't, I'd back everything up and nuke it. Start with a fresh WP install and begin movings things slowly, one at a time.

If a fresh WP install won't work either, I'd start troubleshooting the server (or rebuilding it).

Improve this answer
2
  • That could be, however, I think this site is on a Managed GoDaddy server. Which is the absolute worst... I'll check if I even have DB access.. thanks for the suggestion, the nuclear option be the only way..
    – grzybowski1911
    May 23 at 1:20
  • My pleasure! I suggest you don't go nuclear unless you absolutely have to - you should have access to the DB because PHP has access to it via wp-config.php, so you should have the database name, username and password. You should be able to find phpMyAdmin in your managed GoDaddy settings. Let me know if you have any more questions or need help debugging the database (I think that's the most likely culprit).
    – alex
    May 23 at 1:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.