Whenever I try to update my Permalink settings or use the Theme Editor to modify some file, I am redirected to a 404 page. This also happens when I update the All-In-One SEO Pack plugin's settings. This does not happen in the case of other settings pages or plugin options. I have tried re-uploading WordPress from a fresh local copy, and have also tried deactivating all plugins. My hosting provider has given up, blaming WordPress. What is wrong here?

Some things I suspect:

  • My .htaccess file. I am not using anything extra, other than turning off mod_security.
  • Suhosin. After a recent security breach, my provider recompiled PHP with Suhosin. I have disabled it currently, which solved a lot of compatibility problems with other plugins.
  • File/folder permissions.
  • PHP memory issues, maybe?
  • 1
    Are you using a commercial theme or something homemade? I've seen a couple of themes that hook into awkward places in the admin area leaving broken pages and unintended redirects. A site I looked at this morning was redirecting users to a wp_die message when they tried to edit links. Nov 23, 2010 at 6:22
  • I am using a commercial theme from Smashing Magazine. Fact is, I've been using it for almost 2 years now, and have never had these issues. Recently, the shared server where my website was hosted was breached and they had to reinstall their stuff, and only after that am I experiencing such problems. So I'm quite sure that the theme is not the culprit!
    – GPX
    Nov 23, 2010 at 7:48

1 Answer 1


Double check mod_security and ask hosting to check its logs. It can be configured to ignore .htaccess and obscure 404 in admin seems like something it does at times.

I had to ask my hosting to explicitly whitelist WP core files some files in mod_security on their end for everything to work properly.

  • I had figured out that it would come to this. What are the implications of excluding core files from the mod_security rules? Wouldn't it leave my website open to hackers again?
    – GPX
    Nov 23, 2010 at 14:58
  • I am no expert on security. From my understanding mod_security is merely additional firewall layer. As any firewall it must be configured so that stuff that should work does work. As any firewall it is neither single or critically important security measure.
    – Rarst
    Nov 23, 2010 at 18:57
  • Good enough, then. Can you tell me what all files I should ask them to whitelist? Or can I just ask them to whitelist wp-admin/*?
    – GPX
    Nov 24, 2010 at 4:58
  • Depends on your hosting's specific mod_security config. It's not really mod_security breaks everything. It's mod_security breaks specific file, doing specific thing because of specific rule. My hosting declined to whitelist all of WP core so we went through logs and whitelisted files that triggered errors one by one.
    – Rarst
    Nov 24, 2010 at 6:22
  • Well my hosting company said they won't modify the rules. Goodbye, crappy hosting company. I will be migrating my domain soon. Thanks for the help!
    – GPX
    Nov 25, 2010 at 12:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.