403 Error post.php

What is the ownership and permissions on that file? Do they match the other files in wp-admin, wp-includes, wp-content, etc.? (Hint: they should.)

permissions of all the files in wp-admin (rwxr-xr-x)
wp-content and wp-includes is a mix of (rwxr-xr-x) and (drwxr-xr-x)

all the files are own by the web-server

That looks correct. When you say “owned by the web server”, what user is that?

this is the information that i get when I SSH into the server
-rwxr-xr-x 1 www-data www-data 8123 Oct 11 2017 post.php

OK, phooey, that’s correct.

So the 403 is not coming from the file system. Let’s make sure that PHP is running as www-data. What do you see for “ps -ef | grep php”?

root@https:~# ps -ef | grep php”
root 21989 21974 0 17:50 pts/1 00:00:00 grep –color=auto php”

Odd.

What’s in your server’s access and error logs?

172.56.21.58 - - [14/Jun/2018:18:03:10 +0000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 660 "https://aftercoffeedesigns.com/wp-admin/post.php?post$
172.56.21.58 - - [14/Jun/2018:18:03:10 +0000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 2159 "https://aftercoffeedesigns.com/wp-admin/post.php?pos$
172.56.21.58 - - [14/Jun/2018:18:03:10 +0000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 2779 "https://aftercoffeedesigns.com/wp-admin/post.php?pos$
172.56.21.58 - - [14/Jun/2018:18:03:10 +0000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 2587 "https://aftercoffeedesigns.com/wp-admin/post.php?pos$
172.56.21.58 - - [14/Jun/2018:18:03:11 +0000] "GET /wp-content/uploads/2016/02/mantrans02c-150x150.jpg HTTP/1.1" 200 4585 "https://aftercoffeedesigns$
::1 - - [14/Jun/2018:18:03:17 +0000] "OPTIONS * HTTP/1.0" 200 126 "-" "Apache/2.4.18 (Ubuntu) OpenSSL/1.0.2g (internal dummy connection)"
172.56.21.58 - - [14/Jun/2018:18:03:18 +0000] "POST /wp-admin/post.php HTTP/1.1" 403 742 "https://aftercoffeedesigns.com/wp-admin/post.php?post=5755&$

• This reply was modified 6 years, 8 months ago by Steven Stern (sterndata).

Interesting. You get a 200 there. Are you using mod_security?

yes

That’s it. Getting mod_security right for WP is a daunting task. Disable it for now and study up on Google. (I’ve never gotten it right, FWIW.)

Thanks that fix it

• This reply was modified 6 years, 8 months ago by ae3erdion.