403 error when posting link in forum

…when I try to include a link of any sort (to a website, or to a youtube link, etc)…

I don’t see anything specifically in the log entry that indicates exactly what is being blocked. The Request_URI looks really ugly, but not something that should be blocked so what exactly does including a link mean? Post an example link and exactly how you are trying to “include” it.

Thanks for the usual quick response ??

Here’s a link to a previous forum post at my forums that worked fine:
https://www.npmb.com/3/forum/general-paddling/stikine-river-gopro-2014/

It’s just a post with a plain text URL that WP magically turns into a nice embedded video.

Right now I can’t even make a post with a simple URL to website. Again, just a plain text link like: https://www.yahoo.com/ will result in a 403 error page on making the forum post (forum posts without any URLs in them work fine).

I’ll admit, as per my usual M.O., I updated both BPS and my Simple:Press plugins just a few days ago. So, maybe the forum plugin is doing something new and weird. The REQUEST_URI: does look a bit odd.

Just hoping to find the right solution/fix for this issue. I’ll keep working on it at my end. Thanks again.

hmm yeah I can’t think of any code in BPS that would block plain links like that. It could be some odd chain reaction of things so do these steps below and let me know what happens.

1. Go to the BPS Security Modes page, click Create default.htaccess File AutoMagic button and activate Default Mode.
2. Create a new test post with a link in it.

Followed your steps above.

When testing posting with a link, the result was a standard WP 403 page (not a BPS 403).

Testing post without link worked fine.

Looks like maybe I’ll need to track this down through the forum plugin authors.

Hmm it could be the wp-admin htaccess file blocking something. Not very likely, but possible. Delete the wp-admin htaccess file on the Security Modes page.

Never seen this before. I tried to check your site with Built With and Built With is being blocked. It is looking more and more like your host has implemented some kind of server security that may be causing the issue.

Wierd stuff. The root of your site is blocking Builtwith but not the /3/ URL?
https://builtwith.com/?http%3a%2f%2fwww.npmb.com%2f3%2f

That is weird. Thanks for the heads-up. I’ll see what’s happing in my root.

I have another website running the exact same setup (BPS and Simple:Press) on a server with the same setup. That website has the WP installation in the root directory (not a sub like /3/), and I’m having the same problem with trying to post links in forum posts.

I deleted the wp-admin .htaccess. No change.

I’ll keep digging.

Your server logs will probably help pinpoint what is going on. Maybe it has to do with Simple Press itself. Something like it is triggering a mod_security security rule or some other server security rule. BPS will log all 403 errors when your site is using root folder BulletProof Mode. When you switch to Default Mode then your server is handling 403 error logging by default again.

And something about that BPS Security Log entry just does not look right. Like something is missing or was stripped out. It seems incomplete or something like that. Maybe just a fubar Query string to begin with somewhere in Simple Press.

This is another long shot, but worth trying. When i look at your Source Code i see that you are using this plugin: Fluid Video Embeds. try deactivating it and see if you can post a link.

Deactivating the FVE plugin had no effect. I think most signs seem to point to an ajax issue with the Simple:Press plugin. I’ll pursue that avenue to see what I can dig up. Thanks again.

Doing a bit more digging…

Found that I CAN post URLs – but ONLY if the URL is not the first character of text in the post form.

In other words, if I add a blank line (return), or even just a blank space before the URL, or if the URL comes later on in the context of a post – then it works fine.

All the posts that returned 403 errors happened when a URL was right at the start of the post.

I’ll pass this along to the authors at Simple:Press and see if they have any ideas.

Again, thanks for your great plugin ??

Good troubleshooting to isolate exactly where the root problem is. You should also contact your host about this and give them all the info. A scenario like this could be happening: your host server has a security rule that is blocking the string since it matches that server security rule. The security rule would be looking at $_POST content and not the Query string, but I thought this was worth mentioning below.

In BuddyPress the Query String for a new Topic looks like this.

/post-new.php?post_type=topic

What appears to be missing in the Simple Press Query string is the executing page/script. To me it looks like a malformed Query string.

/[something should probably be here and it is not]?new=topic

Thread has been resolved due to not being a BPS plugin issue/problem. If you want to post whatever the cause of the problem was and the solution whether it is a Simple Press, host server or other issue/problem then that might help someone else out. Thanks.