MyBB Community Forums

Detailed description of your problem, including steps to reproduce if necessary:
Some members on my forum are encountering a 403 error when they post a thread or edit a thread, but it doesn't happen all the time. I have never encountered it using my own account or one of my test accounts. All the permissions seem to be in order. It's not like it happens everytime or to ever member. It happens only to a few members maybe like 8 out of 100 members have encountered it. And once they encounter it, it stays there for a while, but after a while, it sometimes goes away.

URL to your forum/URL to specific problematic page
www.cheatempire.net

New installation or upgrade (from which version of MyBB)?
It is a new installation, but I have switched servers and I believe I did it correctly.

Test user account (if it requires additional permissions)
Will provide upon request, but I doubt it'll help since MOST members are able to do everything just fine.

Screenshot or error text, verbatim
I haven't encountered it before, but members are saying it looks like this:
Error 403
Forbidden You don't have permission to access /newthread.php on this server. Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.


I have removed my custom 403 error page to see if that helped, but it didn't. Not quite sure what could possibly be wrong. All permissions seem fine "All of the required files and directories have the proper CHMOD settings." I migrated my dns from cloudflare directly to the server (been done a week ago) and that didn't help. Still always have one or two members report that they are getting a 403 error. My .htaccess file is just the default one that includes a redirects to my custom error pages. ): Help?

I think I'll give it a little bump. Even the smallest suggestion would help. (: I've been recently thinking that it might be my hosting provider, but I'm not too sure. ):

Do these users have anything else in common? The browser they use or are they using a proxy for example?

This looks like your host's mod security rules.

the 404 is because you don't have a custom 403 page setup... or it's not in the correct directory... which isn't a big deal.

For the 403, you need to try to find as much detail as possible. time and what the user was trying to do when the error happened so your host can look at the logs and determine which rule needs to be white listed.

you can TRY to go to them with roundabout detail, example: 'between 4pm-4.30pm GST getting 403 with newthread.php', but it depends on your host tech support and how far they're willing to dig. The more details the better so they can track it down.

Okay, I've asked one of the users. They've said that they got the 403 error while posting in some forums only and it didn't help when they switched browsers... I find that quite weird as I don't think I've done anything different in one forum as another. They are not using any types of proxies.

Quote:For some reason I was only finding the errors when I tried to post a thread in Money Methods or Freebies

I actually removed my custom 403 error page since I stupidly though that it might fix the issue. I can easily add it back on.

The 403 error was encountered various times, the latest reported to me at 11:42 AM Pacific Time on April 21st, 2014. That user encountered it while posting a new thread /newthread.php. My host probably does not have the best support. They are small and are run solely by 2 users. I can contact them if I have to though.


Am I able to change my host's mod security rules?

were these users trying to add attachments at the time?

---

It does sound like a mod_security issue.

(2014-04-22, 05:06 AM)Leefish Wrote: [ -> ]were these users trying to add attachments at the time?

---

It does sound like a mod_security issue.

They were not trying to upload attachments. Just a thread. Would it be possible to change the mod_security issue? I've done some googling and it does seem I am able to change the mod_security through .htaccess. Do you have any suggestions? Should I change it, switch hosts or anything else?

I can switch hosts, but I really don't want to.

I think you can try via htaccess - if it does not work then ask the host if they can turn it off for your site.