The Meerkat

I asked a user to refresh a couple of times, and it is not occurring for them.

Sent.

DOCUMENT_ROOT on my host is always set: https://php71.nfshost.com/
There shouldn’t really be anything my simple WordPress site is doing to intentionally un‐set it.

Theme has already been changed many times, and no plugin deactivation helped the issue. Sorry. ??

I saw you asking others to post wp-check.php results here, so here’s mine:
https://i.imgur.com/zQcodkj.png

I added the following to my theme’s functions.php:

remove_action( 'shutdown', 'wp_ob_end_flush_all', 1 );

This removed that error, and no others are being produced anywhere on the site, whether backend or frontend (as far as I can tell). The problem in my original post remains.

The only PHP error on broken admin pages is:
Notice: ob_end_flush(): failed to send buffer of zlib output compression (0) in /home/public/wp-includes/functions.php on line 3719
… but it appears on the homepage and non‐broken admin pages as well.

Nothing in the firewall log seems seems to be responsible:

09/Mar/17 23:07:47  #3726096  info         -  [redacted IP]  POST /wp-login.php - Logged in user - [TheMeerkat (administrator)] - monochromaticrp.com
09/Mar/17 23:13:12  #3983253  info         -  [redacted IP]  GET /wp-admin/plugins.php - Plugin deactivated by TheMeerkat - [Name: login-security-solution/login-security-solution.php] - monochromaticrp.com
09/Mar/17 23:13:30  #8933896  info         -  [redacted IP]  GET /wp-admin/plugins.php - Plugin deactivated by TheMeerkat - [Name: login-security-solution/login-security-solution.php] - monochromaticrp.com
10/Mar/17 02:46:23  #8010085  info         -  [redacted IP]  GET /wp-admin/plugins.php - Plugin deactivated by TheMeerkat - [Name: php-compatibility-checker/wpengine-phpcompat.php] - monochromaticrp.com
10/Mar/17 03:45:27  #8742236  info         -  [redacted IP]    GET /wp-admin/plugins.php - Plugin deactivated by TheMeerkat - [Name: bbp-style-pack/bbp-style-pack.php] - monochromaticrp.com
10/Mar/17 03:52:34  #2664687  info         -  [redacted IP]    GET /wp-admin/plugins.php - Plugin deactivated by TheMeerkat - [Name: bbp-toolkit/bbp-toolkit.php] - monochromaticrp.com
10/Mar/17 07:49:07  #2147020  medium     306  [redacted IP] GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 5.5;Windows NT)] - monochromaticrp.com
10/Mar/17 12:31:25  #4886215  info         -  [redacted IP]  POST /wp-login.php - Logged in user - [TheMeerkat (administrator)] - monochromaticrp.com

And it still happens resetting everything under “HTTP response headers” to the default, aside from Strict‐Transport‐Security.

Anecdotally, I can confirm it works really, really well—if someone doesn’t have permissions, there’s no evidence the forums even exist anywhere on the site.

7 characters is hideously insecure. I would strongly suggest educating them on password strength policy.

Fixed it myself. I was using the WordPress HTTPS plugin, which doesn’t play very nicely on my server, apparently. I disabled it and fiddled with some things manually that were listed in the codex.