0

I am running (for a client) a Wordpress site on a CentOS/WHM/Apache 2.2 server, and within a subdirectory we have AWStats installed. Everything working fine until we apply password protection through the htaccess file. With password protection in place, it results in a 404 error when attempting to view the AWStats.

After a lot of trial and error, we discovered that it's down to the Wordpress htaccess rules.

Adjusting them with the following:

# BEGIN WordPress  
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]  
# The following line is the line we added  
RewriteCond %{REQUEST_URI} ^wp-content/stats(.*) 
RewriteCond %{REQUEST_FILENAME} !-f  
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

(AWStats was installed in a subfolder of wp-content as this results in the fewest issues with Wordpress)

Which worked fine, until a Wordpress automatic update erased all changes and restored this htaccess block to default. Making this change and removing the # Begin/End Wordpress markers results in 500 Errors all over the place when the next Wordpress update occurs as it simply adds another one of these blocks.

Everything I have tried seems to not work.

What I have tried:

  1. Adding the htaccess rewrite condition with a write-to-self rule separately, both prior to and after the Wordpress segment. This results in the 404 problem.

  2. Adding the htaccess rewrite condition with a write-to-self rule in an htaccess file within the AWStats directory. This results in the 404 problem.

  3. Adding an htaccess file within the AWStats directory with the directive; RewriteEngine Off. This results in the 404 problem.

  4. Creating a subdomain for the AWStats directory. This just results in a configuration error within AWStats (that I can't seem to fix, so for someone who understand the configuration settings of AWStats better than I might be able to use this solution).

  5. Removing password protection. Not ideal, this site is already the target of Wordpress comment spammers, referrer spammers, and every other PITA who wants to abuse a poor defenceless Wordpress website.

I would like to resolve this without granting the client access to cPanel, as they want several people to have access to the stats data in the AWStats (yes, we do also have Analytics installed on the site, the client wants AWStats as well) who shouldn't have access to everything that cPanel would give them.

Does anyone have a suggestion or experience in resolving this particular issue?

2
  • 1
    Presumably AWStats operates entirely outside of WordPress? So you simply want to exclude the WP routing when the this folder is accessed? Not sure why you would need to put this in the wp-content folder? The directive you've added would seem to break the WP "pretty" URLs? Since the request will only be routed via index.php when it matches ^wp-content/stats(.*)? I guess # This is the line we added isn't actually present in your actual code as that would result in a 500 error (line-end comments are not supported).
    – MrWhite
    Sep 26, 2016 at 16:22
  • Yes, the # This is the line we added wasn't actually in the htaccess file. I couldn't italicise a code segment. Sep 27, 2016 at 7:59

1 Answer 1

0

The only solution I have found is to manually edit one of the core files of Wordpress to have this line included whenever the Permalinks are updated.

In wp-includes/class-wp-rewrite.php starting at line 1512 (WP v4.6.1), in the mod_rewrite_rules() method within the WP_rewrite class:

$rules = "<IfModule mod_rewrite.c>\n";
$rules .= "RewriteEngine On\n";
$rules .= "RewriteBase $home_root\n";

// Prevent -f checks on index.php.
$rules .= "RewriteRule ^index\.php$ - [L]\n";

And it is here I added my own line.

$rules .= "RewriteCond %{REQUEST_URI} ^wp-content/stats(.*)\n";

(The method continues for a lot more lines before completing the Wordpress block of commands within the .htaccess file, should one need to edit any of these yourself, simply edit where you need the directives to sit in the sequence)

I am going to work on a custom function to take over this within the theme I have made for this client, to handle any changes to this files during Wordpress updates. This was the quick-and-dirty fix.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .