403 Permission Denied on all comments

What are the permissions on wp-comments-post.php?

Hi Mika,

That is a very good point. It is set to 0644.

All folders are set to 0755 and all files are set to 0644, with the exception of .htaccess which was set to 0404 and is now 0644.

Could it be a problem with a mod_sec rule on the host, that I’ve seen referred to elsewhere? I’ve asked them but no response yet.

The .htaccess file is heaving with lines added by the Bullet Proof Security plugin, but that has been on there since the start and comments weren’t affected.

Maybe. I’ve had stupid things happen with the new mod_security (they have new default rules which don’t upgrade cleanly) but usually they error out with a 500. Is anything in your server log for comments?

Thanks for your help so far Mika.

There are two error logs that I can see.

One in public_html with ~400 lines, the last month being 2-5 lines per day all saying;
PHP Fatal error: Class ‘GA_Admin’ not found in /home..[]..wp-content/plugins/google-analytics-for-wordpress/googleanalytics.php on line 1583
These stop on the 29th Nov.

The error log file in wp-admin has 828 lines, but from November onwards they are also only the same GA PHP error, about twice a week, stopping on 27 Nov.

Nothing in either file relating to comments. My host came back to my mod_sec query with BS that they couldn’t help with third-party code or debugging websites so still waiting a coherent response after throwing a wobbly in reply.

Is there any chance this is a dodgy dashboard setting? I’ve checked a few times but seems not, and I can’t find many similar problems online.

Well the normal debug route is to turn off all the plugins and see if it works. Have you started that?

Absolutely. I’ve turned off all plugins on the site and the network, and still not been able to comment, as well as trying Jetpack comments and CommentLuv to see if that made a difference.

This is the only site (of 3) on the network that is having the problem, so I also changed the theme to see if that was causing a conflict.

None of that made any difference tho. :/

Wait, only one site?

Step back. What’s special about that site?

What happened right before this started happening?

Well, it’s the only Domain Mapped site, the others are not really up to much, just a test site and a semi-started project.

Could it actually be Google Analytics? Also the only site with that plugged in. I setup GA about the 28/29 October and the last comment was a couple of days before that (site doesn’t get many so far).

I can’t think of anything else major that I did around then other than playing with plugins. I noticed comments were broken when someone gave me a heads up a couple weeks ago…

Actually I had a theme problem with pagination and permalinks about that time, so I had to create a new ‘home’ page to resolve that. Not sure that could be related.

My host came back to say mod_sec isn’t enabled on the server and there haven’t been any recent changes.

Bump for any pointers, I’ve never debugged a site before. Is the only way to fix this going to be learning how to debug from the codex? The timing is impeccable.

Don’t bump (I was reeeeeeally busy).

Well, it’s the only Domain Mapped site, the others are not really up to much, just a test site and a semi-started project.

Turn off domain mapping for that site. Does it work?

Aaargh. When I turn of domain mapping the comments do work ??

Dislike. What do you recommend? Fixable? Really not what I need now. Why isn’t anyone else having this problem – my theme?

I updated to 3.5 without any problems. (Sorry for the bump btw, wasn’t aware it is bad form and thought someone else may spot it and chip in.)

Well we’re just narrowing things down now ??

Okay so that’s actually good! Turn on mapping again.

What mapping options did you check?

Woo! lol. I assume you aren’t also in GMT timezone and up all night like me? ?? Happy to provide coffee either way.

My domain mapping has the server IP, no CNAME and only option 2 checked of the five available;

1.Remote Login
2.Permanent redirect (better for your blogger’s pagerank)
3.User domain mapping page
4.Redirect administration pages to site’s original domain (remote login disabled if this redirect is disabled)
5.Disable primary domain check. Sites will not redirect to one domain name. May cause duplicate content issues.

This was the safest/best setup for me when I read the codex, as I didn’t want site problems and don’t have other users logging in. I log into ‘the problem site’ at problemsite.com/wp-admin/ and everything works. Clicking on Network Admin options (update page, Network dashboard etc) redirects me to the primary domain to login again (as the same user).