# 404 errors when updating options in admin dashboard

Whenever I try to update my Permalink settings or use the Theme Editor to modify some file, I am redirected to a 404 page. This also happens when I update the All-In-One SEO Pack plugin's settings. This does not happen in the case of other settings pages or plugin options. I have tried re-uploading WordPress from a fresh local copy, and have also tried deactivating all plugins. My hosting provider has given up, blaming WordPress. What is wrong here?

Some things I suspect:

• My .htaccess file. I am not using anything extra, other than turning off mod_security.
• Suhosin. After a recent security breach, my provider recompiled PHP with Suhosin. I have disabled it currently, which solved a lot of compatibility problems with other plugins.
• File/folder permissions.
• PHP memory issues, maybe?
• Are you using a commercial theme or something homemade? I've seen a couple of themes that hook into awkward places in the admin area leaving broken pages and unintended redirects. A site I looked at this morning was redirecting users to a wp_die message when they tried to edit links. – goldenapples Nov 23 '10 at 6:22
• I am using a commercial theme from Smashing Magazine. Fact is, I've been using it for almost 2 years now, and have never had these issues. Recently, the shared server where my website was hosted was breached and they had to reinstall their stuff, and only after that am I experiencing such problems. So I'm quite sure that the theme is not the culprit! – GPX Nov 23 '10 at 7:48

Double check mod_security and ask hosting to check its logs. It can be configured to ignore .htaccess and obscure 404 in admin seems like something it does at times.
I had to ask my hosting to explicitly whitelist WP core files some files in mod_security on their end for everything to work properly.
• I am no expert on security. From my understanding mod_security is merely additional firewall layer. As any firewall it must be configured so that stuff that should work does work. As any firewall it is neither single or critically important security measure. – Rarst Nov 23 '10 at 18:57
• Good enough, then. Can you tell me what all files I should ask them to whitelist? Or can I just ask them to whitelist wp-admin/*? – GPX Nov 24 '10 at 4:58
• Depends on your hosting's specific mod_security config. It's not really mod_security breaks everything. It's mod_security breaks specific file, doing specific thing because of specific rule. My hosting declined to whitelist all of WP core so we went through logs and whitelisted files that triggered errors one by one. – Rarst Nov 24 '10 at 6:22