CanSpice

Yeah, that’s what it looks like is happening. If I look at the raw apache access logs, requests to xmlrpc.php are returning a 301 status code (permanent redirect). I’ll send a query to my host to find out if he’s set up a global redirect (I know there have been security issues before that he’s probably tamped down).

After checking my error logs, it appeared that a lot of my files had been group-writable. After doing a chmod -R g-w *, everything appears to be working again.

After poring through logs and with the help of my web provider, I’ve figured it out.

The Apache server runs mod_security, which is set up to look through URIs and HTTP_REFERERs and whatnot, trying to match malicious strings to keep the server safe.

I recently posted a story whose permalink URI contained “python-“, which happens to match one of the regular expressions mod_security tests.

When you load a page, the HTTP_REFERER for the stylesheet for that page is that page’s URI, so the HTTP_REFERER for the stylesheet for the “python-” post contained “python-“, so mod_security said “OH NO YOU DON’T” and returned a 404 for the stylesheet.

Then because Apache is smart, on subsequent reloads of any page (whose URI does not contain “python-“), the HTTP return code for the stylesheet is 304, meaning it hadn’t changed, which is correct. In combination with the previous pseudo-404, some browsers wouldn’t reload the stylesheet, and thus all pages loaded after the “python-” page was loaded would appear in their “raw” unstyled form.

I “fixed” this by changing the permalink of the Python post to be “pythons-” instead of “python-“. This means it doesn’t trip the mod_security regular expression, and everything goes on just fine.

What a funny problem. ??

And now at least I’m serving up XHTML too. ??

I have changed doctypes to XHTML and fixed the stylesheet link to include the closing slash (and tried to fix as many of the other errors, but can’t because WP enjoys sticking tags in where they don’t belong), but this does nothing to fix the problem. If I try to load the stylesheet through my browser, I get redirected to my WP 404 page.