DomenLo

@clairobscur @ckup This is a mod_security issue, one of the rules is causing it, contact your host about removing it. It’s triggered by the < character.

Weird, you’re getting 403, most of us are getting 404.

Judging by the people that “fixed” this in the last couple of hours this seems to involve a new mod_security rule (on the host) throwing a fit when a < character is involved. Host removing said rule fixes the issue.

Judging by the people that “fixed” this in the last couple of hours this seems to involve a new mod_security rule (on the host) throwing a fit when a < character is involved. Host removing said rule fixes the issue.

Judging by the people that “fixed” this in the last couple of hours this seems to involve a new mod_security rule (on the host) throwing a fit when a < character is involved. Host removing said rule fixes the issue.

Same issue, it hangs on the < character to be more specific. Even if the whole content contains just this character, it will 404.

@rtwk I’m guessing your code got cleaned up in some way, seems to be same character (the “less than” character in HTML)

• This reply was modified 8 years, 5 months ago by DomenLo.

Not really useful, but here are two access logs, one with < and one without <

when i include <

MYIP – – [13/Oct/2016:10:44:53 +0200] “POST /wp-admin/post.php HTTP/1.1” 404 6603 “https://SITEURL/wp-admin/post.php?post=3975&action=edit&#8221; “BROWSERAGENT”

When i dont include <

MYIP – – [13/Oct/2016:10:44:06 +0200] “POST /wp-admin/post.php HTTP/1.1” 302 229 “https://SITEURL/wp-admin/post.php?post=3975&action=edit&#8221; “BROWSERAGENT”

I have error_log access (via cpanel), but it looks like it’s empty. I turned on the debug.log logging and all it logs is a deprecated issue regarding US_Widget_Contact.

Notice: The called constructor method for WP_Widget in US_Widget_Contact is deprecated since version 4.3.0! Use __construct()

Checked for updates, still on latest everything.

No, the post or change does not get published. Even if i click on “save draft” it goes to the 404 error.

It appears when I click on the publish/update button. “Error 404 – page not found” on wp-admin/post.php (file is there of course)

The post can include only the single < character (and nothing else) and it will throw the error.

For people stumbling on this topic, here’s a good path to explore: https://www.ads-software.com/support/topic/wp_nav_menu-list-only-2nd-level-separate-submenu/

I ended up using this, it’s just perfect: https://wordpress.stackexchange.com/questions/2802/display-a-portion-branch-of-the-menu-tree-using-wp-nav-menu/2809#2809

I would love to see “site lockout notification” emails that contain what specifically they tried to access…

So that it’s an intuitive way to see if it’s a hack attempt or something an admin/user messed up.

—

Also, working hidden backend on domain mapping ??

Was missing define( 'SUNRISE', 'on' );, i will now go and sit in a corner.

I am, yes. This one: https://www.ads-software.com/extend/plugins/wordpress-mu-domain-mapping/

I’ve noticed that it fixes the issue if I add more domains into the rewritecond entries. So if I just add all of them, it fixes the “issue” ??