Edit .htaccess file to make file accessible

Question

I was trying to make a WordPress plugin work, when I found, after hours of debugging, trial, errors and praying ancient Greek gods, that the plugin did not work because it was impossible for the server to reach a particular file.

The website is hosted in a basic shared hosting environment, so the only thing that can be configured is a .htaccess file. This file is full of rules but I eventually found which one was causing the issue with the plugin:

RewriteRule ^wp-content/(?!themes/.*/core/css/custom\.css\.php$)(.*)\.php$ [R=404,L] 

When I commented out this rule, the plugin started working normally.

Now, I'm not a server or .htaccess expert but the person who coded this rule had some security treat in mind, so I would like to change it so that it simply allows my file to work.

The path of my file is:

wp-content/plugins/plugin-name/public/js/service-worker-loader.js.php 

Can you help me?

Answer 1

RewriteRule ^wp-content/(?!themes/.*/core/css/custom\.css\.php$)(.*)\.php$ [R=404,L] 

Aside: As written, this rule/directive is not correct. It is "missing" a second argument. (The third/flags argument will be treated as the second argument and result in requests that match this pattern being erroneously rewritten to the literal "URL" [R=404,L] - which is obviously not a valid URL and will likely result in a 404 in a very roundabout way... by WordPress, not Apache.)

I would expect the above rule to have a single hyphen (ie. -) as the second argument. For example:

RewriteRule ^wp-content/(?!themes/.*/core/css/custom\.css\.php$)(.*)\.php$ - [R=404] 

The L flag is not required here.

(That might seem subtle to the casual reader, but it is a glaring error/typo.)

HOWEVER, you do not need to modify that rule to resolve your issue. (Without knowing more about this, I would avoid editing this rule in case it was a WP plugin, rather than a "person", that wrote it. Although the fact that it is currently "wrong" as written still remains.) Instead, you can just add an additional rule at the very top of the .htaccess file to make an exception for the file in question. For example:

# Prevent further processing when file is requested RewriteRule ^wp-content/plugins/plugin-name/public/js/service-worker-loader\.js\.php$ - [END] 

This assumes Apache 2.4. (If you are on Apache 2.2 then use the L flag instead of END.)

This rule prevents any other mod_rewrite directives in the remainder of the .htaccess file being processed when that file is requested.

---

UPDATE:

Would it be possible to place a rule in another htaccess placed in the same directory of the file we're trying to grant access to? Or the higher htaccess takes precedence?

Yes, you can do that. Create another .htaccess in the subdirectory and simply disable the rewrite engine. For example:

# /subdirectory/.htaccess RewriteEngine Off 

Since mod_rewrite directives are not inherited by default, this effectively overrides the mod_rewrite directives in the parent (directory) config. The mod_rewrite directives in the parent are not processed so the request is not blocked.

(Each Apache module is processed differently. Directives from other modules, such as mod_expires, would still be processed in the parent/root config.)