403 for blogs folder caused by Disable Directory Browsing

  • Resolved conorfi

    (@conorfi)


    7 years, 9 months ago

    Hello,

    Since I started using this plugin i have been getting a 403 error for my blogs folder
    for Google crawls and can see the same error using Screaming Frog SEO spider.

    After some investigation i found that the root cause is the following setting in the .htaccess file.
    Options -Indexes

    and could see the problem in the log file of my website
    [Sun May 21 09:51:11 2017] [error] [client 109.77.232.190] Directory index forbidden by Options directive: /var/www/vhosts/74/684389/webspace/siteapps/WordPress-107280/htdocs/blogs/, referer: https://conorfi.com/

    This setting is due to the fact i have selected to Disable Directory Browsing.
    (Disable Directory Browsing – Security > Settings > System Tweaks > Directory Browsing)

    The description of this change is “Prevents users from seeing a list of files in a directory when no index file is present”

    I understand that in principle it is a good security practice to prevent browsing of directories but what do users do when a folder they want a folder such as ‘blogs’ to be made accessible?
    I have tried several workarounds without success

Viewing 6 replies - 1 through 6 (of 6 total)

  • Hey @conorfi How’s it going?

    I just installed the ScreamingFrog SEO tool and ran it against one of my sites and couldn’t replicate your problem, so three suggestions for you;

    1 – Restart iThemes Security from the installed plugins page by DEACTIVATE and then as soon as your screen refreshes ACTIVATE. I’ve found that updating your banned users lists with a large block list makes your site unusable for some reason – the restart on the plugin is a bit of a dirty fix, but it works.

    2 – FTP to your blogs directory and check to make sure that the directory itself hasn’t been set to hidden

    3 – Consider switching off “prevent browsing of directories￡ and beef up your “banned users” list and install Disable REST API and Disable XML-RPC plugins to keep the bad guys out

    I just checked my own settings in Security > Settings > System Tweaks > Directory Browsing and I have it switched off as well, so something else in your environment might be causing your problem

    Thread Starter conorfi

    (@conorfi)

    Thanks @markartisan for your reply.
    I should have stated in my original post that if i remove
    Options -Indexes
    from .htaccess file it resolved the issue.
    But looking for an approach that keeps the setting but allows me access /blogs

    Thread Starter conorfi

    (@conorfi)

    @markartisan the blogs folder returns a 403 due to the setting Options -Indexes
    If i remove it or place an empty index file in the blog folder it returns a 200.
    But i want a solution whereby the setting ‘Options -Indexes’ is kept and blogs folder is accessible

    • This reply was modified 7 years, 9 months ago by conorfi.

    @conorfi

    Simply create a new .htaccess file with ‘Options +Indexes’ in the (sub)folder where you want directory listing enabled.

    Also make sure there is no index file in the (sub)directory.

    Thread Starter conorfi

    (@conorfi)

    @pronl thanks for your help, much appreciated

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘403 for blogs folder caused by Disable Directory Browsing’ is closed to new replies.