ManageWP wp-admin 500 error

[Aventura]

OK so first I tried to fix the logs – disabled every plugin (bar managewp) and tried again. No luck.

So I tried your new suggestion and got a new error, 403: http://img163.imageshack.us/img163/3856/managewpnewerror.png

Thank you for all your help so far – currently I still have the customcode in the htaccess whitelisting the plugin folder but HEAD is still in the filtered request methods just to clarify the current setup.

[AITpro Admin]

Deactivating / disabling plugins does not necessarily remove everything.  Example:  The Sucuri plugin creates an .htaccess file in your wp-content folder when you use/choose the wp-content one-click hardening option.  The only way to remove that .htaccess file is to FTP to your website and delete it.  I believe the same is true of some options/features in Better WP Security and of course BPS requires that you deactivate BulletProof Modes instead of deactivating the BulletProof Security plugin.

Moving on since some progress appears to be happening with the 403 error instead of seeing a 500 error.

Delete your wp-admin .htaccess file if it is not already deleted at this point.  And yep, remove HEAD.  Let me know what happens at this point and we can move on to the next thing.

[Aventura]

OK So…

HEAD removed AND no wp-admin htaccess but Bulletproof is ON = WORKS

(inc. whitelist and commenting out from earlier)

[AITpro Admin]

Ok so the issue/problem is a combination of things.  HEAD definitely needs to be removed.  We know that.  Now activate wp-admin BulletProof Mode and let me know what happens.

[Aventura]

Back to original 500 error with admin htaccess back on

[AITpro Admin]

I forgot to tell you to remove HEAD from the wp-admin .htaccess file.  Remove HEAD and let me know what happens.

[Aventura]

That makes more sense – same 500 error

[AITpro Admin]

Ok now let’s narrow down which security rules are causing the issue.

The most likely security rules are going to be these below.  Comment all of these out in your wp-admin .htaccess file.

#RewriteCond %{HTTP_USER_AGENT} (libwww-perl|wget|python|nikto|curl|scan|java|winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner) [NC,OR]
#RewriteCond %{THE_REQUEST} \?\ HTTP/ [NC,OR]
#RewriteCond %{THE_REQUEST} \/\*\ HTTP/ [NC,OR]
#RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [OR]
#RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [OR]
#RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC,OR]
#RewriteCond %{QUERY_STRING} ftp\: [NC,OR]
#RewriteCond %{QUERY_STRING} http\: [NC,OR]
#RewriteCond %{QUERY_STRING} https\: [NC,OR]

[Aventura]

OK its one of them.

Should I re add the commented out lines in bulletprood htaccess root?

[AITpro Admin]

Yep, ok let’s see if it is the User Agent security rule.  It may be that ManageWP uses wget or cURL.

Uncomment ONLY this rule and test …

RewriteCond %{HTTP_USER_AGENT} (libwww-perl|wget|python|nikto|curl|scan|java|winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner) [NC,OR]

…if it is not that one then uncomment them 1 by 1 until you find the problem rule.

[AITpro Admin]

Once we find out which rule or rules is the issue/problem then you will do the same thing in the Root .htaccess file that works for the wp-admin .htaccess file.

[Aventura]

The culprit:
#RewriteCond %{THE_REQUEST} \?\ HTTP/ [NC,OR]

Should I undo the changes to the root htaccess file now or only some?

Thanks again so much for all your help

 

[AITpro Admin]

It may also be that just the wp-admin .htaccess file is going to be the issue, but most likely whatever is done in the wp-admin .htaccess file will also need to be done in the root .htaccess file.

[AITpro Admin]

Ok now comment out ONLY this rule in both your Root (you can uncomment all the other rules you commented out in the root .htaccess file) and wp-admin .htaccess files and test.  Then uncomment this rule in your root .htaccess file and test.

[Aventura]

My Bad – whatever order I did something in it appears my root file is already using a fully uncommented version that also includes HEAD. So currenty the only changes are: whitelist of plugin, removal of head and comment out one rule in wp admin file. To be thorough I added HEAD back to admin file and it worked. I also commented out custom plugin whitelist and it still works. So it looks like its just that one line that broke it – what does that line do out of interest?

[Author]

Posts