I’m helping a colleague with a recurring issue that’s just started happening to multiple sites of his after upgrading to the latest release of WP… He had 4 sites go down today. Here’s the message he received back from the server host…
The coding that wordpress posts into
the .htaccess file is basically being
re-pasted in a malformed fashion.
Basically we just separate these two
as you can see below. Contrary to the
post statement I had seen previously,
there is nothing in the apache logs
files indicating any changes to you
site. Neither are there entries over
cpanel or FTP. All methods of
compromise have been exhausted. I do
not believe your scripts are being
compromised in any manner. This is an
issue within wordpress itself. Have
there been any changes to the blogs,
or perhaps any changes that effected
all accounts recently?
The curious part to me in the extract of contents from hit .htaccess file is this:
</IfModulden
# END Word</Limit>
AuthName siteeakers.net
AuthUserFile /home/site/public_html/_vti_pvt/service.pwd
AuthGroupFile /home/site/public_html/_vti_pvt/service.grp
Here is the full text from the hosting provider or the before and after htaccess fix…
Before…
root@cherry [/home/site/public_html]# cat .htaccess
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModulden
# END Word</Limit>
AuthName siteeakers.net
AuthUserFile /home/site/public_html/_vti_pvt/service.pwd
AuthGroupFile /home/site/public_html/_vti_pvt/service.grp
Options All -Indexes
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
After…
root@cherry [/home/site/public_html]# cat .htaccess
AuthName siteeakers.net
AuthUserFile /home/site/public_html/_vti_pvt/service.pwd
AuthGroupFile /home/site/public_html/_vti_pvt/service.grp
Options All -Indexes
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
This
is definitely a replace operation gone wrong. It should probably read
Update: I think I found some related bugs:
WordPress Bug #11903
WordPress Bug #12324
the latter was closed as a duplicate of the former. From what I can see, the function WordPress uses to write the
.htaccessfiles can crash on a busy server.11903 seems to have a patch. If this is your problem, maybe try it out.
Things like this are why you should never, ever try to update a live system. Have a local or parallel copy to try things out with; Then do a simple directory rename to replace the running versions.