Download Link Error

The problem is that your set up is blocking access to the download.php file in the Email Before Download plugin directory.

So, if I try to get to this URL, I get a 403 Forbidden:
https://jaguaraudiodesign.com/blog/wp-content/plugins/email-before-download/download.php

That has to be fixed or no one will be able to get to your download files. Strangely, the URL to checkcurl.php works:
https://jaguaraudiodesign.com/blog/wp-content/plugins/email-before-download/checkcurl.php

That’s pretty unusual to have one php program blocked and another working like that when both are in the same directory. Hmmm. My guess is that you have the Wordfence plugin set to block access to the WP-Content directory … or you have the Wordfence Firewall turned on … or some combination of the two. The Firewall being on might explain why checkcurl.php is accessible but the other stuff isn’t. Anyway, regardless, you have to let the outside world get to the download.php script in the EBD plugin directory or things won’t work.

Note this could also be a permissions problem on the files themselves. The download link that is being generated is actually incorrect because it is going to https://jaguaraudiodesign.com/blog/wp-content/plugins/email-before-download/?somerandomcharacters
when it should be going to:
https://jaguaraudiodesign.com/blog/wp-content/plugins/email-before-download/download.php/?somerandomcharacters

That’s weird too. Not sure what would cause that, but could be file/directory permissions or could be the Wordfence plugin. Or, all this could also be caused by certain Apache configurations.

Just a side note, when you are to “both” or to “email” in the EBD settings, then EBD will actually send 2 emails out. One email is supposed to go to you (the WordPress administrator) to let you know someone filled in the download form. I call that email the “notification email”. The other email goes to the email address that the website visitor typed into the form (ie the website visitor’s email address). Right now, you are sending both emails to the website visitor’s email address. This is because you changed the TO: value in the Contact Form 7 field. It won’t hurt anything to leave it like you have it, but it’s not the normal way … normally the email configured from that screen (the “notification email”) is just to let you know something happened (that’s why it doesn’t have a link to the download file).

Thank you very much for the detailed reply.

I am using both the Wordfence and BulletProofSecurity plugins. Several months ago I had some issues with BPS and the root HTaccess file. When I went through the plugin setup wizard it was causing the site to go down and I ended up replacing the file with a new generic one to get the site visible again.

However, I thought de-activating each plugin would allow me to determine if one was causing the problem, but I de-activated both and the problem was unchanged.

Well it could be webserver configuration. Or it could be leftover htaccess files that don’t get removed when the plugins are disabled. Or maybe directory or file permissions. Or if you’ve modified download.php in the EBD plugin directory then perhaps it’s broken and never runs. I can’t really debug it any further with the state that you’re in — there’s nothing for me to look at that I can actually get to.

You could install a new wordpress instance in another directory somewhere (if your hosting provider allows you to do that), then installed CF7, EBD, and Download Monitor and try it there & see if it works. That would get you a clean instance without any leftover security stuff or whatever… A bit of work, but not more than an hour or so probably….

I’m checking on whether there’s an issue with the server, but the support people I’ve been using with the host have been pretty useless.

I looked at the permissions and all the folders are 755. The download.php file is 644; I also tried 744 and I couldn’t access the link:

https://jaguaraudiodesign.com/blog/wp-content/plugins/email-before-download/download.php

I could rebuilding wordpress, but the EBD plugin is no longer available in the WP repository, to I don’t know how I can reinstall that to the new WP site.

this won’t fix anything, but it may give us some more info to go on — make a copy of download.php under a new name (in the same directory). For example, copy download.php to blah.php and update this item so I can try and access it. I’m curious if we can get to it under a different name or if download.php is outputting something that’s causing the failure.

I tried putting an x in front of the name. Produces the same result on my computer.

https://jaguaraudiodesign.com/blog/wp-content/plugins/email-before-download/xdownload.php

Have you modified the php code itself at all?

Change the name to xdownload.txt so I can access it and look at it & make sure it looks ok. Normally, going to download.php like we were trying to do should work and it just gives you an empty web page … or, at least that’s the way it used to work. Maybe that got changed in the most recent version & that’s what you’re using. Or, maybe yours is corrupted somehow. If you make it a .txt then I can look at the code & see if that tells us anything…

Resolved – the offending plugin was IP Geo Block.

This plugin was essential to prevent all the bots with Russian IP addresses from hacking my WP login, but I’ve disabled it for now until I figure out how to configure it to not cause this problem.