Reference: http://wordpress.org/support/topic/cant-access-a-separate-file-in-another-folder-on-my-site-403-error/page/3#post-5232011
The WordPress Firewall 2 plugin prevents BPS from being able to save custom code to Custom Code text boxes and also prevents the htaccess File Editor from working.
Recommendation: Delete the WordPress Firewall 2 plugin.
Reasons for Recommendation:
The WordPress Firewall 2 plugin has not been updated in over 3 years.
BPS already protects against the things that the WordPress Firewall 2 plugin is protecting against using .htaccess code/files instead of doing this at the php level. .htaccess files/code is processed first before php code and is a much more effective firewall method.
The WordPress Firewall 2 plugin does whitelist the wp-admin / WordPress Dashboard area by default, but there is a code mistake so that default whitelist rule is not working correctly. If you would still like to keep using the WordPress Firewall 2 plugin then see the fix below.
Fix the WordPress Firewall 2 plugin: Keep using the WordPress Firewall 2 plugin and fix the code mistake so that the wp-admin / WordPress Dashboard area is whitelisted. BPS / BPS Pro will be able to function normally after making this code correction below.
Open and edit this file: wordpress-firewall-2.php at code line 158 and add the Yellow highlighted code below.
function WP_firewall_check_exclusions() {
$request_string = WP_firewall_check_whitelisted_variable();
if ( is_admin() ) {
return;
}
if($request_string == false) {
//nothing to do
} else {
...
...
...
.
