Bad pages redirection

I have a wordpress web site with only a private pages (can only be viewed by logged users)

I use the below code in my theme functions.php to be redirected to login page each time a put the page URL on the browser.

add_action( 'wp', 'redirect_private_page_to_login' );
function redirect_private_page_to_login(){
    $queried_object = get_queried_object();
    if (
        isset( $queried_object-post_status ) 
        'publish' === $queried_object-post_status 
        ! is_user_logged_in()
    ) {
        wp_safe_redirect( wp_login_url( get_permalink( $queried_object-ID ) ) );
        exit;
    }
}

When i put my page URL on the browser

example : https://website.com/page1 I should be redirected to :

https://website.com/wp-login.php?redirect_to=https%3A%2F%2Fwebsite.com%2Fpage1%2F

It works but Sometimes i'm redirected to https://website.com/index.php . It happen frequently with Edge and safari browsers (that is my issue).

I think something is wrong in the redirection of the pages. It probably come from my .htaccess . I want to share it with you and hope someone can help me with this.

Note: I use SecuPress as security plugin. i have also a subdomain that why you will find test.website.com in the .htaccess

HTACCESS

# BEGIN SecuPress no_x_powered_by
IfModule mod_headers.c
    Header unset X-Powered-By
/IfModule
# END SecuPress
# BEGIN SecuPress readme_discloses
IfModule mod_rewrite.c
    RewriteEngine On
    RewriteBase /
    RewriteRule ^(.*/)?(readme|changelog|debug)\.(txt|md|html|log)$ - [R=404,L,NC]
/IfModule
# END SecuPress
# BEGIN SecuPress wp_version
IfModule mod_rewrite.c
    RewriteEngine On
    RewriteBase /
    RewriteRule ^readme\.html$ - [R=404,L,NC]
/IfModule
# END SecuPress
# BEGIN SecuPress bad_url_access
IfModule mod_rewrite.c
    RewriteEngine On
    RewriteBase /
    RewriteCond %{REQUEST_URI} !wp-includes/js/tinymce/wp-tinymce\.php$
    RewriteRule ^(php\.ini|wp-config\.php|wp-includes/.+\.php|wp-admin/(admin-functions|install|menu-header|setup-config|([^/]+/)?menu|upgrade-functions|includes/.+)\.php)$ [R=404,L,NC]
/IfModule
# END SecuPress
# BEGIN SecuPress directory_listing
IfModule mod_autoindex.c
    Options -Indexes
/IfModule
# END SecuPress
# BEGIN SecuPress php_disclosure
IfModule mod_rewrite.c
    RewriteEngine On
    RewriteCond %{QUERY_STRING} \=PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC]
    RewriteRule .* - [F]
/IfModule
# END SecuPress
# BEGIN SecuPress bad_file_extensions
IfModule mod_rewrite.c
    RewriteEngine On
    RewriteBase /
    RewriteRule ^wp-content/uploads/.*\.(\.9|73i87a|386|aaa|abc|aepl|aru|atm|aut|bat|bhx|bin|bkd|blf|bll|bmw|boo|bps|bqf|breaking_bad|btc|buk|bup|bxz|ccc|ce0|ceo|cfxxe|chm|cih|cla|cmd|com|coverton|cpl|crinf|crjoker|crypt|crypted|cryptolocker|cryptowall|ctbl|cxq|cyw|czvxce|darkness|dbd|delf|dev|dlb|dli|dll|dllx|dom|drv|dx|dxz|dyv|dyz|ecc|enciphered|encrypt|encrypted|enigma|exe1|exe_renamed|exx|ezt|ezz|fag|fjl|fnr|fuj|fun|good|gzquar|ha3|hlp|hlw|hsq|hts|iva|iws|jar|kcd|kernel_complete|kernel_pid|kernel_time|keybtc@inbox_com|kimcilware|kkk|kraken|lechiffre|let|lik|lkh|lnk|locked|locky|lok|lol!|lpaq5|magic|mfu|micro|mjg|mjz|nls|oar|ocx|osa|ozd|p5tkjw|pcx|pdcr|pgm|php|php2|php3|pid|pif|plc|poar2w|pr|pzdc|qit|qrn|r5a|rdm|rhk|rna|rokku|rrk|rsc_tmp|s7p|scr|scr|shs|ska|smm|smtmp|sop|spam|ssy|surprise|sys|tko|tps|tsa|tti|ttt|txs|upa|uzy|vb|vba|vbe|vbs|vbx|vexe|vxd|vzr|wlpginstall|wmf|ws|wsc|wsf|wsh|wss|xdu|xir|xlm|xlv|xnt|xnxx|xtbl|xxx|xyz|zix|zvz|zzz)$ - [R=404,L,NC]
/IfModule
# END SecuPress
# BEGIN SecuPress hotlink
IfModule mod_rewrite.c
    RewriteEngine On
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteCond %{REQUEST_FILENAME} \.(jpg|jpeg|png|gif)$ [NC]
/IfModule
# END SecuPress
# BEGIN WordPress
# The directives (lines) between `BEGIN WordPress` and `END WordPress` are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
IfModule mod_rewrite.c
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
/IfModule
# END WordPress
# Protect wp-config.php
files wp-config.php
order allow,deny
deny from all
/files
# Redirection to HTTPS
RewriteCond     %{SERVER_PORT} ^80$
RewriteRule     ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]
RewriteCond %{HTTP_REFERER} !^http://test.website.com/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^http://test.website.com$      [NC]
RewriteCond %{HTTP_REFERER} !^http://website.com/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^http://website.com$      [NC]
RewriteCond %{HTTP_REFERER} !^http://www.test.website.com/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^http://www.test.website.com$      [NC]
RewriteCond %{HTTP_REFERER} !^http://www.website.com/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^http://www.website.com$      [NC]
RewriteCond %{HTTP_REFERER} !^https://test.website.com/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^https://test.website.com$      [NC]
RewriteCond %{HTTP_REFERER} !^https://website.com/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^https://website.com$      [NC]
RewriteCond %{HTTP_REFERER} !^https://www.test.website.com/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^https://www.test.website.com$      [NC]
RewriteCond %{HTTP_REFERER} !^https://www.website.com/.*$      [NC]
RewriteCond %{HTTP_REFERER} !^https://www.website.com$      [NC]
RewriteRule .*\.(jpg|jpeg|gif|png|bmp)$ - [F,NC]
# BEGIN MINIORANGE MEDIA RESTRICTION
# The directives (lines) between `BEGIN MINIORANGE MEDIA RESTRICTION` and `END MINIORANGE MEDIA RESTRICTION` are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
RewriteCond %{REQUEST_FILENAME} ^.*(png|jpg|pdf|doc|docx|xlsx|xls|mp4|ppt|pptx|mov|mpeg|avi|m4v|svg|wmv|bmp)$ [OR]
RewriteCond %{REQUEST_URI} protectedfiles 
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in.*$ [NC]
RewriteRule . - [R=403,L]
# END MINIORANGE MEDIA RESTRICTION
# BEGIN cPanel-generated php ini directives, do not edit
# Manual editing of this file may result in unexpected behavior.
# To make changes to this file, use the cPanel MultiPHP INI Editor (Home  Software  MultiPHP INI Editor)
# For more information, read our documentation (https://go.cpanel.net/EA4ModifyINI)
IfModule php7_module
   php_value upload_max_filesize 25M
   php_value post_max_size 128M
   php_flag display_errors Off
   php_value max_execution_time 2000
   php_value max_input_time 600
   php_value max_input_vars 4000
   php_value memory_limit 512M
   php_value session.gc_maxlifetime 1440
   php_value session.save_path /var/cpanel/php/sessions/ea-php74
   php_flag zlib.output_compression Off
/IfModule
IfModule lsapi_module
   php_value upload_max_filesize 25M
   php_value post_max_size 128M
   php_flag display_errors Off
   php_value max_execution_time 2000
   php_value max_input_time 600
   php_value max_input_vars 4000
   php_value memory_limit 512M
   php_value session.gc_maxlifetime 1440
   php_value session.save_path /var/cpanel/php/sessions/ea-php74
   php_flag zlib.output_compression Off
/IfModule
# END cPanel-generated php ini directives, do not edit

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php74” package as the default “PHP” programming language.
IfModule mime_module
  AddHandler application/x-httpd-ea-php74 .php .php7 .phtml
/IfModule
# php -- END cPanel-generated handler, do not edit

Thanks you in advance for your help.

Regards.

Topic private htaccess pages login Wordpress

Category Web

1
answered at 
# Redirection to HTTPS
RewriteCond     %{SERVER_PORT} ^80$
RewriteRule     ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

This rule is in the wrong place. It needs to go before the # BEGIN WordPress comment marker. ie. Before the WordPress front-controller.

Currently, this will result in a redirect to /index.php if requesting HTTP.

# BEGIN SecuPress hotlink
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteCond %{REQUEST_FILENAME} \.(jpg|jpeg|png|gif)$ [NC]
</IfModule>
# END SecuPress

And this block is incomplete/wrong. Unless you know the missing directives, this block must be deleted.

Fortunately, it's "only" making the next RewriteRule (in the WordPress code block) superfluous, but it could potentially break your site.

About

Geeks Mental is a community that publishes articles and tutorials about Web, Android, Data Science, new techniques and Linux security.