Using VestaCP with nginx + httpd on CentOS 6.7

The website works perfectly, but to load php files from javascript failes since it gives 403 error.

I have tried the following: (Every folder got the same owner and permissions (755) )

wp-content/test.php  // Error 403
wp-includes/test.php // Error 403
wp-admin/test.php    // OK, 200
test/test.php        // OK, 200
wp-contest/test.php  // OK, 200

In fact... wp-content/*.php and wp-includes/*.php fails, including php in subdirectories inside these folders.

Any php file located in wp-content and wp-includes give me automatically 403 error, even when these files doesn't exists, I got 403 instead of 404.

  • I checked nginx.conf and there is nothing related with wp-content/wp-includes
  • I checked .htaccess, nothing weird, I even removed it after backing it up.
  • Folder permissions are 755 and files are 644
  • Also tried with restorecon -R /home/$user/web/url/public_html

Nothing worked, I don't think this is wordpress related since files are loaded standalone, instead, it must be server related.

Aditional data:

  • We use cloudflare with proxy disabled, I don't think it inherited any config from the previous owner which causes this issue, but I wouldn't discard it.
  • The website has been just migrated from hosting to our vps
  • I'm sysadmin and we got about 60 websites, anyother site doesn't have this issue :/
  • Side note: If you suspect this is mostly a WordPress thing rather than a UNIX thing, there's also a Stack Exchange for WordPress development, which might cover this better. I don't know WP well enough to say for sure. – Anko Dec 14 '16 at 17:41
  • @Anko as I said in the question: "I don't think this is wordpress related since files are loaded standalone, instead, it must be server related.", but however, I'm not 100% sure :/ – Mc Kernel Dec 14 '16 at 17:44
  • Perhaps straceing your server program would help to check whether it's trying to open the files you expect it to, and whether it's encountering problems with file permissions. Something like strace -e trace=file <server run command>. – Anko Dec 14 '16 at 17:55
  • hm, never heard about strace... I just installed it but I ain't sure about how to use it... with trace=file do you mean just trace=file or trace=foobar.php? also... <server run command> would be "ls"? – Mc Kernel Dec 14 '16 at 18:03
  • What command do you run to get your webserver running? Replace <server run command> with that. Strace tells you what system calls the given program is making, so you can see if any calls to open(<path to whatever file>) are failing with errors, such as "EACCES (Permission denied)". – Anko Dec 14 '16 at 18:09

Well, I feel ashamed to say that there was another .htaccess in wp-content and wp-include folders with the following rule:

<FilesMatch "\.(?i:php)$">
  <IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
  <IfModule mod_authz_core.c>
    Require all denied

Many hours smashing my head with the keyboard because of it.


Make sure you don't have a return value for a directory which might override your custom rules

  • you mean in *.php files? I have tried with empty php files or containing just <?php echo "hi"; ?> – Mc Kernel Dec 14 '16 at 17:51
  • In the apache configuration for the vhost – Timothy Frew Dec 14 '16 at 17:54
  • If all else fails eliminate this by backing up your current apache configuration and replace it with another site that works. Then tweak to work with that site. If the problem exists still then it's more than likely either caused by: – Timothy Frew Dec 14 '16 at 17:55
  • A) .htaccess B) Wordpress – Timothy Frew Dec 14 '16 at 17:55
  • Yea... reinstalling the site and config if like my last hope... – Mc Kernel Dec 14 '16 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.