Wordpress Akismet JS and CSS - Forbidden?

Hey there guys!

---

I'm trying to figure out why the JS and CSS of Akismet is getting blocked, I can't find the rule!
I'm running a vanilla Centminmod 123.09beta1, I haven't touched the nginx configuration files for this domain.

Code:

[error] 29472#29472: *172 access forbidden by rule, client: [CLIENT IP], server: [SERVER], request: "GET /wp-content/plugins/akismet/_inc/akismet.css?ver=3.1.11 HTTP/1.1", host: "[HOST]", referrer: "http://[HOST]/wp-admin/index.php"

I tried commenting out the wpsecure_[DOMAIN].conf nginx include but still getting the same!
What rule could be blocking it?

Cheers!

 

Hey there eva2000!

I got "Wordfence Security" installed, tried again by disabling it but still getting access forbidden.

WordPress was installed through option 22 of centminmod menu (Add Wordpress Nginx vhost + Cache Plugin).

This is the output for the plugin status:

Code:

37 installed plugins:
  A accesspress-social-counter 1.5.9
  A admin-color-schemes        2.2
  A akismet                    3.1.11
  A amp                        0.3.2
  A attachment-pages-redirect  1.0
  A cache-enabler              1.1.0
  A cloudflare                 1.3.24
  A contact-form-7             4.4.2
  A disable-xml-rpc            1.0.1
  A duplicate-post             2.6
  A easy-fancybox              1.5.7
  A insert-headers-and-footers 1.3.3
  A fb-instant-articles        3.0.1
  A jetpack                    4.1.1
  A mikado-core                1.0
  A mikado-instagram-feed      1.0
  A mikado-twitter-feed        1.0
  A page-links-to              2.9.6
  A regenerate-thumbnails      2.2.6
  A revslider                  5.2.6
  A tinymce-advanced           4.3.10.1
  A user-role-editor           4.26.1
  A vaultpress                 1.8.3
  A white-label-cms            1.5.7
  A widget-clone               1.1
  I wordfence                  6.1.10
  A wp-mail-smtp               0.9.5
  A js_composer                4.12
  A wp-bitly                   2.3.2
  A wp-gallery-custom-links    1.11
  A wpml-cms-nav               1.4.19
  A sitepress-multilingual-cms 3.4.1
  A wpml-sticky-links          1.3.19
  A wpml-string-translation    2.3.9
  A wpml-widgets               1.0.4
  A wordpress-seo              3.3.4
  A wpseo-news                 3.3

Legend: A = Active, I = Inactive

Content of vhost conf files:

Code:

# Centmin Mod Getting Started Guide
# must read http://centminmod.com/getstarted.html

# redirect from non-www to www
# uncomment, save file and restart Nginx to enable
# if unsure use return 302 before using return 301
server {
            listen   80;
            server_name [SERVER NAME];
            return 301 http://[DOMAIN]$request_uri;
       }

server {
 
  server_name [SERVER NAME];

# ngx_pagespeed & ngx_pagespeed handler
#include /usr/local/nginx/conf/pagespeed.conf;
#include /usr/local/nginx/conf/pagespeedhandler.conf;
#include /usr/local/nginx/conf/pagespeedstatslog.conf;

  #add_header X-Frame-Options SAMEORIGIN;
  #add_header X-Xss-Protection "1; mode=block" always;
  #add_header X-Content-Type-Options "nosniff" always;

  # limit_conn limit_per_ip 16;
  # ssi  on;

  access_log /home/nginx/domains/[DOMAIN]/log/access.log main_ext buffer=256k flush=60m;
  error_log /home/nginx/domains/[DOMAIN]/log/error.log;

  include /usr/local/nginx/conf/autoprotect/[DOMAIN]/autoprotect-[DOMAIN].conf;
  root /home/nginx/domains/[DOMAIN]/public;
  # uncomment cloudflare.conf include if using cloudflare for
  # server and/or vhost site
  include /usr/local/nginx/conf/cloudflare.conf;
  include /usr/local/nginx/conf/503include-main.conf;

  # prevent access to ./directories and files
  location ~ (?:^|/)\. {
   deny all;
  }

  include /usr/local/nginx/conf/wpincludes/[DOMAIN]/wpcacheenabler_[DOMAIN].conf;
  #include /usr/local/nginx/conf/wpincludes/[DOMAIN]/wpsupercache_[DOMAIN].conf;
  # https://community.centminmod.com/posts/18828/
  #include /usr/local/nginx/conf/wpincludes/[DOMAIN]/rediscache_[DOMAIN].conf; 

  location / {
  include /usr/local/nginx/conf/503include-only.conf;
 

  # Enables directory listings when index file not found
  #autoindex  on;

  # for wordpress super cache plugin
  #try_files /wp-content/cache/supercache/$http_host/$cache_uri/index.html $uri $uri/ /index.php?q=$uri&$args;

  # for wp cache enabler plugin
  try_files $cache_enabler_uri $uri $uri/ $custom_subdir/index.php?$args;

  # Wordpress Permalinks
  #try_files $uri $uri/ /index.php?q=$uri&$args; 

  # Nginx level redis Wordpress
  # https://community.centminmod.com/posts/18828/
  #try_files $uri $uri/ /index.php?$args;

  }

location ~* /(wp-login\.php) {
    limit_req zone=xwplogin burst=1 nodelay;
    #limit_conn xwpconlimit 30;
    #auth_basic "Private";
    #auth_basic_user_file /home/nginx/domains/[DOMAIN]/htpasswd_wplogin;   
    include /usr/local/nginx/conf/php-wpsc.conf;
    # https://community.centminmod.com/posts/18828/
    #include /usr/local/nginx/conf/php-rediscache.conf;
}

location ~* /(xmlrpc\.php) {
    limit_req zone=xwprpc burst=45 nodelay;
    #limit_conn xwpconlimit 30;
    include /usr/local/nginx/conf/php-wpsc.conf;
    # https://community.centminmod.com/posts/18828/
    #include /usr/local/nginx/conf/php-rediscache.conf;
}

  #include /usr/local/nginx/conf/wpincludes/[DOMAIN]/wpsecure_[DOMAIN].conf;
  include /usr/local/nginx/conf/php-wpsc.conf;
  # https://community.centminmod.com/posts/18828/
  #include /usr/local/nginx/conf/php-rediscache.conf;
  include /usr/local/nginx/conf/staticfiles.conf;
  include /usr/local/nginx/conf/drop.conf;
  #include /usr/local/nginx/conf/errorpage.conf;
  include /usr/local/nginx/conf/vts_server.conf;
}

SSL one is identical except for the SSL configuration.

Finally I just noticed it also happens with the Akismet "form" JS:

Code:

2016/07/18 17:47:05 [error] 29473#29473: *1950 access forbidden by rule, client: [CLIENT IP], server: [SERVER], request: "GET /wp-content/plugins/akismet/_inc/form.js?ver=3.1.11 HTTP/1.1", host: "[HOST]", referrer: "http://[DOMAIN]/[CENSORED]/"

Thank you for looking into it

 

Oh, well... What the..?

Code:

# /home/nginx/domains/[DOMAIN]/public/wp-content/plugins/akismet
location ~* ^/wp-content/plugins/akismet/ { deny all; }
# /home/nginx/domains/[DOMAIN]/public/wp-content/wflogs
location ~* ^/wp-content/wflogs/ { deny all; }

Is this auto-generated? How can I prevent it?

 

Thank you man! There we go!
Also... I just checked out the .htaccess of Akismet:

Code:

# Only allow direct access to specific Web-available files.

# Apache 2.2
<IfModule !mod_authz_core.c>
    Order Deny,Allow
    Deny from all
</IfModule>

# Apache 2.4
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>

# Akismet CSS and JS
<FilesMatch "^(form|akismet)\.(css|js)$">
    <IfModule !mod_authz_core.c>
        Allow from all
    </IfModule>
  
    <IfModule mod_authz_core.c>
        Require all granted
    </IfModule>
</FilesMatch>

# Akismet images
<FilesMatch "^(.+)\.(png|gif)$">
    <IfModule !mod_authz_core.c>
        Allow from all
    </IfModule>
  
    <IfModule mod_authz_core.c>
        Require all granted
    </IfModule>
</FilesMatch>

I believe auto-protect is not converting this one completely correct.

 

I see! Just a simple manual "fix" for now then. Keep up the good job man, thank you