Mike Whitney said
Also another strange seems issue in Admin-Back end.  When I try to edit certain Simple-Press settings it wants me to log-in again.  So I do again but I am not able to edit the setting.  See my SS.

What is the mod_security patch and can I tell my hoster to change something?

I still have these errors when trying to change settings on the forums tab.

‘Mod Security’ is an optional Apache server module that monitors all the urls, query variables, post variables etc., that are sent in the http header of you site on every request. It looks for specific character patterns and if a match is found denies the request. The patterns it is looking for are user-configurable and it is an attempt to root out malicious behaviour – i.e., someone trying to get access to your site with nefarious intent.

It sounds good but is riddled with problems and is the bane of every web developers life. Mainly, of course, because the patterns it is set up to search for are (a) unknown as your host can put in there whatever they deem might be necessary and (b) most often cause arbitrary page loading problems that can be hard to track down.

While we are not necessarily saying that mod security is the cause of your issues it has to be considered as a possible candidate simply because this is the sort of behaviour one would expect – although I have to be honest and say I have never seen the access issue half way through a page load like in the image you posted. Not quite like that anyway. And the ‘for*’ filtering is most bizarre.

I can only speak personally here but if this was me I would be asking my host firstly if mod security is indeed in place on my server and secondly and if so, can it be turned off. Failing turning it off can some of the patterns that are effecting your site be removed which might end up as being an on-going process as new urls get added over time.

I got my host provider to turn off mod_security and unfortunately I am still experiencing the error.

Any ideas where else to look?

Thanks.

Mike

have you confirmed its off?  with php_info() or other?  or forcing it off in .htaccess just to be sure?

other thing would be to check the permissions on your server for the wp-content, plugins and simple-press (and subdirs) folders…  and the php files within simple press…  normally, dirs would be 0755 and php files would be 0644… 

I have confirmed it off.  I PM’d you with PHPINFO.

Folder and file permissions correct.

Thanks.

what about the .htaccess?  any other thoughts as to what on your server would be interfering with query args or url composition?

did you ever install a 3rd party forum application (like phpbb) and perhaps still have a ‘forum’ directory on your server in from it?

I added this to the .htaccess:

<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>

Still same error in backend.

I did have BB installed at one time and have gone through the database and directories to remove what was left over after i un-installed it.  Maybe there is something I missed.

How would that affect the backend error though?

It is probably time to stop tinkering, roll up the shirtsleeves and get drastic.

Would it be possible to turn everything off? By that I mean all other WP plugins AND SP plugins – really all – and your WP theme and try things with just the WP default theme and SP active?

There is no reason that I am aware of that this should fail so if it does then we would know we are looking at something server-side. If it all works OK then re-introduce components one at a time starting with the WP theme and moving on to plugins.

Yes I will start doing that.

How would that affect the WP-Admin section though?

Well, of course, I am not saying that it will but there are plugins that add extra code and features to the admin. This one does for example. We try and ensure that we don’t trip up other items but it is very easy to fail at that. This is really a process of elimination.