cleancoded

Sounds like a caching issue. When you disable WP Rocket, are you able to see images as expected?

Are you able to upload/update plugins without FTP credentials from the WordPress backend area?

Assuming you can, here are a couple things you can do to troubleshoot the issue you are experiencing:

1. Check theme permissions

   If you’re running your site from shared hosting, you’re probably fine here. If you’re using VPS or Cloud hosting, make sure the user account that has access to the web server (Nginx or Apache HTTP) also has access to your theme files.

2. Are you using any security plugins?

   I know you said after disabling all plugins this issue persisted, but it’s a common cause of this error message, so it’s worth repeating to disable those while troubleshooting your backend access of the theme editor.

3. Are you using cloud-based security WAF? Or Cloudflare?

   If so, try disabling WAF, flush cache and try saving changes through the theme editor again. This can happened with Cloudflare, depending on your host and WAF settings, where Cloudflare WAF challenges (does not allow) “Update files” requests at the site level (like your WordPress backend dashboard).

   You can access your Cloudflare firewall logs from your CF account dashboard. If you find this is the cause (you’ll see “challenge” under the “action taken” column), you can whitelist your IP in the Cloudflare WAF event details to resolve.

You’re right, this is not out-of-the-box functionality. Because WordPress is utilized to power any variety of different sites, in different verticals, all doing different things, it provides some basic functionality by default, while leveraging a framework that can be infinitely customized to suit your preferences and business needs. I feel this is actually one of the platform’s greatest strengths.

This being said, restricting editors’ access to specific pages is absolutely doable. Like most things related to WordPress development, there are many ways to do this.

I would personally utilize the “Capability Manager Enhanced” plugin, which is free in the ww.wp.xz.cn plugin repository:

https://ww.wp.xz.cn/plugins/capability-manager-enhanced/

After you install and activate this plugin, go to Users > Capabilities to configure plugin settings.

I found a blog post that provides some step-by-step instructions for setting up this plugin to provide the functionality it sounds like you’re looking for:

https://wpwarfare.com/allow-editors-only-edit-certain-pages-in-wordpress/

For me, the most common cause of a 403 Forbidden error is a corrupt .htaccess file. Verify this by downloading a copy of your current .htaccess file via FTP, so it’s easy to revert later on. Then, delete that file from your server. In an FTP program like FileZilla, right click on the .htaccess file and click “Delete.”

Now try accessing your homepage again. If it loads, this means you had a corrupt .htaccess file. You can generate a fresh file from the Settings » Permalinks page by clicking the “Save Changes” button at the bottom. If your homepage still does not load, you can upload the old .htaccess file back.

I mentioned testing the .htaccess file first simply because it’s the fastest and easiest thing to check. Because this issue happened after you activated a new theme, this sounds like the result of a theme or plugin conflict. If you can still access the admin dashboard, and you change the theme to a default theme, like Twenty Seventeen, are you able to load the homepage successfully?

If so, I would deactivate any plugins you installed and have activated and try activating the new theme again. If the homepage loads, you have a plugin conflict. Because this is a new install, you can just reactivate your plugins one by one until the homepage doesn’t load, to identify the conflict.

Otherwise, you could try installing the “Health Check” plugin (https://ww.wp.xz.cn/plugins/health-check/) which allows you to troubleshoot your site without affecting your normal visitors. Open your site in an incognito window to verify this.

Then, while in troubleshooting mode, from the Plugins page, click the “Enable while troubleshooting” for each plugin, one by one, to identify the conflict.

Is this for a WooCommerce site?

Check out WooCommerce Services; it’s free, it syncs with USPS and works pretty well:
https://docs.woocommerce.com/document/woocommerce-services/

For the custom product/shipping pricing for a specific item purchased by itself or with other items, you’re looking for “dynamic pricing,” which I’ve implemented a few times with this (premium) extension:

https://docs.woocommerce.com/document/woocommerce-dynamic-pricing/

If nothing else, this should get you pointed in the right direction for custom coding a solution if you’re looking to avoid a paid extension.

It sounds like you may have already pursued some steps to resolving the malware issue, but I’d recommend carefully following this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

Is the blank page you’re seeing a 500-server error?

Internal server errors (error 500) are often caused by plugin or theme function conflicts, so if you have access to your admin panel, try deactivating all plugins. If you don’t have access to your admin panel, try manually resetting your plugins (no Dashboard access required). If that resolves the issue, reactivate each one individually until you find the cause.

If that does not resolve the issue, try switching to the default theme for your version of WordPress to rule-out a theme-specific issue. If you don’t have access to your admin panel, access your server via SFTP or FTP, or a file manager in your hosting account’s control panel, navigate to /wp-content/themes/ and rename the directory of your currently active theme. This will force the default theme to activate and hopefully rule-out a theme-specific issue.

If that does not resolve the issue, it’s possible that a .htaccess rule could be the source of the problem. To check for this, access your server via SFTP or FTP, or a file manager in your hosting account’s control panel, and rename the .htaccess file. If you can’t find a .htaccess file, make sure that you have set your SFTP or FTP client to view invisible files.

If you weren’t able to resolve the issue by either resetting your plugins and theme or renaming your .htaccess file, we may be able to help, but we’ll need a more detailed error message. Internal server errors are usually described in more detail in the server error log. If you have access to your server error log, generate the error again, note the date and time, then immediately check your server error log for any errors that occurred during that time period. If you don’t have access to your server error log, ask your hosting provider to look for you.

Try manually resetting your plugins (no Dashboard access required). If that resolves the issue, reactivate each one individually until you find the cause.

If that does not resolve the issue, access your server via SFTP or FTP, or a file manager in your hosting account’s control panel, navigate to /wp-content/themes/ and rename the directory of your currently active theme. This will force the default theme to activate and hopefully rule-out a theme-specific issue (theme functions can interfere like plugins).