I started with the step by step post and I am still getting stuck. Below is the original post with response.
I was able to get the site to work by doing the repair settings. I still have the yellow warning lock. When I try to add the .htaccess redirect, I get this error,
"The Page isn't redirecting properly."
Also, since the repair, the navigation is acting weird in both Explorer and Firefox. See attached image. Any ideas?
So I still need help with:
1. Making the redirect work.
2. updating photos?
3. Weird navigation glitch.
Any brave and kind takers? Thanks!
Quote from: drewactual on January 29, 2019, 07:29:19 PM
Quote from: mcpheex3 on January 29, 2019, 07:09:36 PM
I need help. I may be beyond help, in which case I need the names of consultants I can hire. ;D
I freely admit I barely know what I am doing when it comes to admin'ing a forum. I can't get this SSL thing straightened out.
1. I think the .htaccess file should go in the theflourishforum.com/forum directory because that is where the settings file is? Is that correct? Or should it go in theflourishforum.com?
yes- it should go in the directory with your forum, but MAKE SURE your server looks however layers deep for htaccess files- some can be configured not to.. so... ask your host
2. So basic but ... how do I create the .htaccess file? When I try to save it in notepad or wordpad, it forces a .rtf or .txt extension which can't be deleted.
write it in notepad and upload it to your server, THEN change the name to .htaccess from htacces.txt
3. Does it matter the site goes through cloudflare? I can't even remember what that means except I set it up when we were using the chat feature and I was blowing up my server. I have since deleted chat.
doesn't matter
4. When I test it on whynopadlock, the SSL connection passes, valid certificate, installed correctly. But I get, "Your webserver is forcing the use of SSL." Is that because of cloudfare? Should I get rid of cloudflare?
something in the configuration, either an htaccess or http.d file above your layer is likely forcing.... not a bad thing, but ask your host
5. Protocols, I get this: You currently have TLSv1 enabled.
This version of TLS is being phased out. This warning won't break your padlock, however if you run an eCommerce site, PCI requirements state that TLSv1 must be disabled by June 30, 2018. Say what?
tell your host to update you to the better protocols... if you need a list, I can get it for you
6. I then get 5 hard failures, 8 soft failures, and 2 form failures.
what kind of failures and using what kind of evaluation?
I have been trying to address this for months but every time I try, I get so overwhelmed, I give up. Also, I have a huge FAQ on the main URL which directs to various topics in the forum. This is an integral part of my site and none of the links will work because of this.
Any help is very much appreciated.
for your SSL Cipher Suite, you'll be best served with the following configuration (pass to your host) :
ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256
your SSL protocols are best configured with (pass to your host) :
All -SSLv2 -SSLv3
navigation glitch is likely a simple fix... it's most likely a missing ; in your css, specifically your .nav class A:hover. it should NOT have the 'default' transparent background, but one with an assigned color...
updating photos: it can be glitchy, but attempt using the image proxy setting in your admin section to resolve http/https issues with them.
the redirection needs to be in your htaccess file right on top.
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.yourdomain.com/$1 [R=301,L]
give me a link to your site and i'll peek at the css or perhaps the lack of causing the nav glitch... it is possibly that it's looking for css file still residing in port 80 land as opposed to port 443
You are so helpful!
OK, somehow I got the green padlock to work. My home logo wasn't redirected. DOH! :-\
Will look at the navigation issue (that only started after I updated via the repair settings).
So now the question is... the green padlock is working without the htaccess redirect. Do I still need it?
Also, since I have the green padlock, should I still set the image proxy to checked?
My site: The Flourish Forum (https://theflourishforum.com/forum/index.php).
Thanks again!
oh.... and clear your cache too... your browsers cache- hold shift punch refresh.
Quote from: mcpheex3 on February 04, 2019, 12:57:31 PM
You are so helpful!
OK, somehow I got the green padlock to work. My home logo wasn't redirected. DOH! :-\
Will look at the navigation issue (that only started after I updated via the repair settings).
So now the question is... the green padlock is working without the htaccess redirect. Do I still need it?
My site: The Flourish Forum (https://theflourishforum.com/forum/index.php).
Thanks again!
i'd make sure it's in there if not for the simple virtue of landing at httpS: <important) www(<important) . yoursite.com no matter how a user approaches... example: some dude types in just the domain, boom- he shows up at https://www.... another types in https://yourdomain and he arrives at same location... another, still, uses a bookmark on their browser to find you, and it's looking for http://www.yoursite.com, and it is redirected to httpS://WWW. yoursite..... this is why the =301 part is of value, it tells the index servers this is a permanent redirect so it's not held against you.... and it does no harm to be there.
Oh OK, that makes sense. Thanks!
Should I run the repair settings again to try to work out the nav glitch?
I put the redirect in and it jumped to my home page (https://theflourishforum.com) .
But then it keeps redirecting to my home page. When I click on my forum page, it says, "The page isn't redirectly properly."
I think there is already a redirect in my home root folder. The htaccess file says this:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
order allow,deny
deny from 200.143.140.94
allow from all
When I type in my forum URL (theflourishforum.com/forum) without https or http, it automatically redirects to my root URL (theflourishforum.com). Which is fine, I think.
Yes ... I am pretty much clueless. But I'm really happy that after months of trying to get the greenpadlock I got it! A million thank you's for holding my hand.
ah...
in the .htaccess file that is on the same level as your forum (alongside the directories "Themes" and 'sources' make sure this is atop all else:
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://theflourishforum.com/forum//$1 [R=301,L]
now.... I see you're escaping WWW... this is fine, but you've GOT to be consistent... IF you usually don't use WWW before the domain name, you need to be certain while running repair_settings the URL's listed in it ALSO DON'T USE WWW.
it's a bit of a trick of the web- and why/where these htaccess redirects come to the rescue.
notice in the code above there is no www, and because you're using this for forcing folks to the secure FORUM directory we've implemented that directory's call (the /forum part).
again, this is in the htaccess IN THE SAME DIRECTORY as the forum, NOT the htaccess in the 'home page' directory.
IF it is in the homepage htaccess, you may not need this at all... if it IS in an htaccess of your home page directory, attempt typing in http://www.theflourishforum.com/ and see if it doesn't wisp you away to httpS://www.theflourishforum.com instead.
all we're trying to do here is use htaccess to force not only SSL (https) but also either www or NO www... consistently...
also, in the HTML for your home page (is it WP? perhaps in your header.php file of that theme) you'll need to go through it (use search for http) and change all the links to https instead... this will clear up that issue without burdening the server to do it for you.
Sigh... my site is such a mess. I wasn't consistent in terms of the www or no www.
The .htaccess file I copied earlier is on the home page level (theflourishforum.com). There is no .htaccess file on the forum level (theflourishforum.com/forum). When I put one there, it gives me the page isn't redirecting properly error.
This is where I get kerflooey - the home page has a button which says, "Enter Forum." It is a menu link to the forum page. Before it wasn't working and would just reset to the home page (the link did not have the www). When I changed it to include the www, it will now go to the forum page. ???
But... the links on the FAQ page - none of them have www and it still works. However, it won't let me log in unless there is no www.
Yes, it's a WP site.
When I type in http://www.theflourishforum.com/, it redirects me to https://www.theflourishforum.com.
So... now what should I do? You are an angel by the way.
BTW, the navigation glitch is gone. ::)
for speaking terms, you have four versions of your page hanging out on the interwebs.. one is http, another https, one is www and one is without. there is also a https://www and an http://www... just to confuse you more (which isn't my intent) there is also there is both without...
do you see how quickly this can go sideways? which is why getting it straight is huge.. that's easier done in your htaccess and your hard coded links than anywhere else... i'm not sure how important it is (within https) you choose, but it is crucial to remain consistent.
this isn't going to hurt..... much...
let's go to your top level htaccess, make sure your redirect points to either www or NO www... let's not worry about ANY htaccess changes in your forum at all- remove the redirect if it is there. i think i told you wrong by doing that in the first place.
once that is squared away, go into repair_settings and MAKE CERTAIN they ALL point to URL's either with or without the www, and it is the same thing used in your htaccess.. consistent.
once that is done, you're 99% of the way there.
there is a setting in WP that forces secure (https) and in the same setting area you can specify www. make sure it's there (or not there, depending on if you use www or not). there is also a nice plugin that will make all links point to https from wordpress (actually, it negotiates it for you whether it changes it or not- checking first for https and if not there, then http)...
Now... the most time consuming, but.... you're 99.9% 'there' now...
open your WP theme directory for the theme you're using. open the header.php and use search for "http:"... change them to "https:"... open your sidebar and your footer and do the same... if there are other files such as additional templates- you'll have to go through them too to make sure all point to https.... atop this, if you're using child theme, you may need to access the parent themes and do the same thing as the child often uses portions of the parents templates.
this sounds difficult, but it really isn't- you got this... use the developer tools in chrome or firefox to show you links internal or external.. or even right click in a browser and 'view source', and then find: http: ..... then all you have to do for the stragglers is figure out which part of the template is presenting that html, and go to that file and change http: to https....
WP's backend, along with the repair_settings and the htaccess top level redirect will likely do almost all of the work for you.
you're no more than half an hour from whooping this...
I tried to add the .htaccess file to the forum level again. It still gives me the "page isn't redirecting properly" error. What is strange is that it does redirect to:
https://theflourishforum.com/forum/index.php. If I go to the site normally at that exact same URL (with the .htaccess file deleted) it works. I don't understand how that can be.
Sorry I was posting at the same time.
OK, I think I love you. But first ... I shall give it a whirl. ;D
Before I do though... is there a way to tell which it *should* be www or no www? Or is it purely my preference?
A million thank yous!
I think this may be part of the trouble... the home site (theflourishforum.com) is at www.theflourishforum.com. The forum is at theflourishforum.com/forum/ - NO www. Is that a problem?
yup... choose one.. there is etiquette to consider, but it really doesn't matter. only dinosaurs like me care about the etiquette as the search engines stopped caring some time back (according to articles i've read about the subject)...
here is the thing: if that redirect is right in your htaccess top level file, it doesn't matter how the user approaches, as the redirect will work it's magic and plop them where YOU want them... consistently.
if that redirect is done right, it won't even allow someone to get to the other versions in the first place- which means for you? consistency... for your users? same... consistency brings trust. that little green padlock means you give a dang about what you're doing... the search engines are noticing- and that 301 in your redirect? it tells the engines to hold you harmless for the other three versions of your page (the non-secure and the one with or without www).
the WP (main page) is using a hyperlink to arrive at the (www less) /forum... and... the www less or www present forum is reporting 'not secure' at the forum's top level... AS SOON AS YOU click a link within the forum, it whisps you to NON www and secure with the padlock.
something is defeating the htaccess that exists in the parent directory...
is there a user.ini file in your forum directory? is there one in your top directory? how about a php.ini in either?
Please go to your WP dashboard and settings... filter through those until you find the 'links' settings... make CERTAIN it points to either www (if that's what you're using) or not... ALL of these need to be consistent.
That is so very helpful! I went through all of the steps. I searched the header, footer, sidebar - no http.
The Settings link in the WP dashboard says the WP & Site address is: https://www.theflourishforum.com.
I am pretty sure I found the culprit though... I am using a plugin called, "Really Simple SSL." "Lightweight plugin without any setup to make your site SSL proof." I thought that was just getting everything transitioned to SSL (and I didn't think it went to the forum level).
Enable WordPress 301 redirection to SSL is ON.
Enable 301 .htaccess redirect is OFF.
Enable Javascript redirection to SSL is ON.
There is a "Deactivate plugin and keep SSL" button. Should I do that?
Can I just say how refreshing it is to have someone encouraging me and helping me in a direct, thorough, understandable manner? ;D :-*
I am a numbnut. I'm so sorry I didn't think of that plugin sooner. I installed it months ago and then forgot about it.
It says I can enable the .htaccess redirect (and it is recommended) but only if I have FTP access (which I obviously do). Should I do that?
So, just to clarify... how do I change the forum to www? I see the links for the main site but where would I change it for the forum part?
i think that redirect to https in your top level htaccess stands a pretty good chance it was written by that plugin....
yes.. deactivate it.
THEN....
go to your TOP level htaccess and paste the redirect code in it, and ensure the WP redirect is no longer there.
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://theflourishforum.com/forum//$1 [R=301,L]
(don't forget WITH or WITHOUT WWW... this ^ is 'without'...
and comment out the WP redirect if it is still there after deactivating the plugin... meaning, IF it is there, it should now (make it) look like:
# BEGIN WordPress
#<IfModule mod_rewrite.c>
#RewriteEngine On
#RewriteBase /
#RewriteRule ^index\.php$ - [L]
#RewriteCond %{REQUEST_FILENAME} !-f
#RewriteCond %{REQUEST_FILENAME} !-d
#RewriteRule . /index.php [L]
#</IfModule>
# END WordPress
the little #'s make the engine ignore those directives... this renders your TOP level htaccess to use the more literal redirect without the fancy WP stuff.... and should resolve this issue for you altogether.
to change the forum to www, use repair_settings and ensure the URL's are ALL https://www.... it makes a huge difference..
if those settings are correct EXCEPT for the forum's home URL, you can access your settings.php file and change the "forum's address" to reflect the www.
OK, I will try that. (Makes me nervous!)
If I wanted to lose the www altogether, would I just take it out of the Settings on the WP links?
yup.
that redirect coughing is because of that plugin writing to your htaccess.. when you use the one i provided it should cascade to every directory within the parent directory.
now that you've eliminated that plugin, you're going to have to tell WP to load SSL Secure... it's in the settings area of dashboard.. this will take care of the links inside your WP to make them https...
then... your amazon is loading over http... are you using a plugin to bring that in? if so... navigate to it within your dashboard, and change the URL to https there too.
I changed all of the URLs in the repair settings to include www. Now I get an error message at the top that says, "The default theme's directory is wrong, please correct it by clicking this text."
When I click it, they have all changed to include the www. When I save, it takes me back and still get the same error. :-[
give me a few seconds.... don't go anywhere.
OK. Will do. Also... do I want two forward slashes after forum in the rewrite rule or just one?
RewriteRule ^(.*)$ https://theflourishforum.com/forum//$1 [R=301,L]
sweet baby james... no... you only want the one:
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.theflourishforum.com/$1 [R=301,L]
JUST like that... top of your top level htaccess.... that friggin' slash is ALL on me and thanks to a dirty screen...
with or without the www.... your choice
post the contents of your top level htaccess file?
LOL! Hey, I actually learned something in my Pascal programming class back in 1990! ;D
I tried the new htaccess and I get the Page isn't redirecting properly and it shows the URL as being https://theflourishforum.com/forum//forum/forum/forum/...etc.
The original htaccess was:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
order allow,deny
deny from 200.143.140.94
allow from all
I think I'm going to try it all without the www since the forum part won't work with the www. ;)
Uh oh... can't get back to repair settings ...
i see the WP redirect and a blacklist for an IP...
overwrite ALL of that with the code i gave you..
yeah, it's redirecting from some mechanism... we'll find it. i ain't gonna abandon you until this is fixed.
is there a .user.ini in the SMF directory? how about the top level directory?
dump your local cookies and cache... i used another browser and you're in business!!!!
Aw, thank you!
I don't see a .user.ini (searched the forum dir and top level dir).
I was able to get back to repair settings. I took the www out just until we can figure out what is happening.
Deactivating the simply SSL plugin now makes the forum inaccessible.
I get this: https://theflourishforum.com/forum//forum/forum/forum/forum/forum/forum/forum/forum/forum/forum....
OK! Will do that right now!
Sweet! I'm back up... but no green padlock.
You have helped so much and it's late. I won't blame you if you go to bed and I'll keep working on it some more and in the morning. ;)
when it was deactivated, and using a browser with no memory of your site (or using incognito in chrome, private browsing in firefox) it loaded just fine (well, padlock wasn't green, but that is an easy fix).
so...
make sure it's deactivated.
making WP and SMF play nicely is something i have some experience with ... there is a way... let's get this straight first... don't worry about the forum being inaccessible for right now- deactivate the plugin. freakin' WP tries to do things for you too much, and right now it's making entries in your htaccess and it's using php to redirect... we don't want that foolishness.
no worries... i see ghosts when i sleep.. so... i don't do it.
your padlock.. easy peasy..
using chrome? right click and inspect.. console tab.. it will show you the items not using https, and we're going to fix them.
LOL! No ghosts allowed. ;)
OK, I deactivated. But the only way to get it working was to reload the original .htaccess. Also, when I try to modify a message, I now get this error:
The following error or errors occurred while posting this message:
Your session timed out while posting. Please try to re-submit your message.
Every time...
OK, I will try the .htaccess you gave me again. What about this one from WP:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>
that is what they suggest. :-\
they're just using wildcards... we're hard wiring it.
the sessions thing is something else... we'll get to that. it has to do with something called "2.0.14 login fix". no worries- let's get the redirect back up....
three things of vital importance:
the redirect in the htaccess just as posted prior.
the settings in WP, asking you site URL and Address (there are two lines) must match the URL in the htaccess
the settings in your SMF (easily accessed via repair_settings) must all have https and either www or not, just like ^those two.
you're NOT going to have a green padlock, but... we're gonna get there too. first things first
....... and by the way... you're using http2, which is going to get fun in a little while when i make your page zoom like a Ferrari.
Oh boy! Sounds like fun!
OK, I'm going to run through it. I'm buckling up. ;D
OK, I put in the .htaccess as you wrote it.
Made sure the WordPress Address and Site Address URL are both https://www.theflourishforum.com.
All settings in SMF have https://theflourishforum.com.
It says, "The page isn't redirecting properly."
Should I change all the settings in SMF to https://www.theflourishforum.com and try again?
I can no longer access the WP admin page. :o
wp-settings.php will have the info you need to alter. you can access it ftp or through your cpanel. also, wp-config.php....
OK, I can access through control panel. But...what do I change?
if you want you can PM me your cpanel access and I'll get you squared away... but only because i got you here. i'd rather you do it (even if directed) so you know how and learn how this junk works in the meantime.
the htaccess- comment everything out.. that is put a # in front of every line... this eliminates the threat of it messing with something.
you're going to want to look at your wp-config.php and wp-settings.php... there is something WP is doing that is jacking this up for us...
the SMF settings.php is where a lot of those files URLs you change in repair_settings live... they can be changed there too- it's just not as easy.
Oh OK. Well since I can't see straight right now and my brain hurts, I think I will revert it back for now (I have members all over the world so they access it 24/7). And then try again in the morning.
You are a lifesaver and I really, truly appreciate all of your help with this. ;D
here is some homework for you.
use google chrome and access your site. right click and inspect.. choose the console tab, and it will show you all the unsecured items on the page... we'll be needing to make them secure. it looks like most your items are from your images folder...
just a tidbit: those directories don't change from unsecured to secured, only the way you access them does.. the padlock isn't green as WP is asking for the images over http NOT https. it's a URL in the code we'll have to change.
the redirect works- the one i gave you... but it is conflicting with something WP is doing...
if you want ONE more swing at it tonight, try this:
MAKE a file, call it .user.ini .... that begins with a period.... place it in your SMF directory. INSIDE that file, add the redirect provided above, but put /forum after the .com this time.
.user.ini does the same thing, basically, a htaccess file does except only for php files (which is what we're working with) and only for the directory it's in. this is a bandaide. but.... it should work.
uh... DON'T DO THAT^^^^^
using incognito, your site is working with a green padlock as it is supposed to... both the main and the forum.
congrats!
dump your cache and your cookies.
DO come back tomorrow, though...
my site is a lot heavier than yours, but mine loads in less than a second. we can get yours to do the same because you are using mod_h2 ... I'll do some of my own homework for you in the morning and give you some code that will blow your mind. will assist with your SEO too.
You are a peach @drewactual! I'm sorry it took me a few days to get back. My site is really unstable right now. I deactivated a plugin (All-In-One_Migration) and the whole site went down. I restored it from a back up and it's working but very glitchy. I'm getting lots of 405 and 502 errors.
I think I need to get it off cloudflare. I am looking at changing hosts so I'm not going to make any changes right now. I feel like it's teetering on a pushpin. :-\
take a peek in your server error logs and we can figure it out.
OK, will do!
There are a whole lot of errors in that log. Not even sure where to begin. I think I need to hire a web developer at this point. :(
The only one listed with today's date:
[12-Feb-2019 13:08:23 UTC] PHP Warning: array_unshift() expects parameter 1 to be array, null given in /home/paperwhi/public_html/wp-includes/class-wp-xmlrpc-server.php on line 508
there usually are... it holds the last 300 if it's set up default...
don't sweat the small stuff, and this is small..
read the page: https://themeskills.com/disable-limit-wordpress-heartbeat-api/ and follow the instructions. Heartbeat is bad. :)
Good Morning!
I contacted my host because I wasn't getting anywhere. This was the only error:
a918695813d48c66"] [severity "CRITICAL"] [hostname "theflourishforum.com"] [uri "/forum/proxy.php"] [unique_id "XGT0UK6IDeAACCZeT8MAAAAu"]
[Wed Feb 13 23:53:37 2019] [error] [client 172.69.69.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "=(?:ogg|gopher|data|php|zlib|(?:ht|f)tps?)://" at REQUEST_URI. [file "/usr/local/apache/conf/mod_sec/mod_sec.asl.conf"] [line "508"] [id "340165"] [rev "279"] [msg "Atomicorp.com UNSUPPORTED DELAYED Rules: Uniencoded possible Remote File Injection attempt in URI (AE)"] [data "/forum/proxy.php?request=http://jp29.org/cal182.jpg&hash=934799445227f8e9a918695813d48c66"] [severity "CRITICAL"] [hostname "www.theflourishforum.com"] [uri "/forum/proxy.php"] [unique_id "XGT0Ua6IDeAACBUDk8QAAABw"]
[Wed Feb 13 23:53:51 2019] [error] [client 66.249.73.219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "=(?:ogg|gopher|data|php|zlib|(?:ht|f)tps?)://" at REQUEST_URI. [file "/usr/local/apache/conf/mod_sec/mod_sec.asl.conf"] [line "508"] [id "340165"] [rev "279"] [msg "Atomicorp.com UNSUPPORTED DELAYED Rules: Uniencoded possible Remote File Injection attempt in URI (AE)"] [data "/forum/proxy.php?request=http://4.bp.blogspot.com/-cavd_y-yilc/vghip4cm8mi/aaaaaaaabzy/kl5cqi0rgp8/s1600/bent%2bbrass%2b10%2baa.jpg&hash=51c2a4756bd5982274fb0e4e6e5f7b46"] [severity "CRITICAL"] [hostname "theflourishforum.com"] [uri "/forum/proxy.php"] [unique_id "XGT0X66IDeAAB8qoIogAAABI"]
This is what he did:
I have white listed the rule to avoid the blocks from modsecurity I would suggest you to update your plugins or themes. If the issue persists again please get back us with exact time stamp so that we can check it from our end.
This all started after updating three plugins which I had to rollback when I did a restore from a backup.
Is this related at all to the forum? Everything is working fine now except the forum won't hold my login information so I have to log in every time I go on and every time I do any admin change.
At this point I will let sleeping dogs lie! ;D
mod_security is a known issue with SMF, and it isn't the mod_security itself, but the way it's implemented.
if at all possible, disable it for your page. it can often be done in your htaccess... if you can't or if this tweaks your host- ask them to provide you with the configuration they use so it can be socialized here in a new thread... you'll draw support from folks more knowledgeable than me over it's 'better' configuration.
if you wish to attempt shutting it off and seeing how long your host let's you get by with it (they may not care?) enter in your htaccess:
<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>
and.... i've been checking your page out from time to time, and it seems solid from my vantage- though i obviously haven't logged in or anything..
Thank you very much for all of your help and feedback. It has really been a lifesaver for me. Since things are working right now, I won't touch anything. ;D Strange I never had the problem before but perhaps something with the switch to SSL set it off.
In any event, you are a peach! :-*