Forum Replies Created

Viewing 4 replies - 1 through 4 (of 4 total)
  • Thread Starter rlkz

    (@rlkz)

    FYI, this issue seems to have cleared, and backups are resuming for most sites.

    Hi @stevejburge – Confirmed that the 2.40.0 release resolves fatal errors on two sites we manage. Thanks for the quick investigation/resolution.

    Cheers

    Hi @vmarko – I’ve played around with a small site that had the issue, and I believe I have found the culprit.

    For this particular site (centralmachinery.ca), W3TC was already in place for a year plus without issue. After a recent upgrade, a visit to the site would suddenly result in a 500 Internal Server Error, which would not go away unless this particular line (which is faulty – bad syntax) was removed from .htaccess:

    Header set Public-Key-Pins "pin-sha256="$pin"; pin-sha256="$pinbak"; max-age=31536000"

    If the line was removed, and the site refreshed, it would be added back immediately, and the 2nd page refresh would result in a 500.

    The only solution was to disable/delete the w3tc plugin directory, and then strip the htaccess file. A re-install of the plugin would result in same behaviour, as it was pulling configs from the wp-content/w3tc-config/master.php file. If that file is deleted prior to a new install/activation, the site responds as expected. So that may be one quick fix for you @tutumu – Backup that master.php file, delete it, install latest version, and re-run setup guide. You should be good to go.

    However, if within the Browser Cache Settings of the plugin, under Security Headers, HTTP Public Key Pinning is enabled, that offending line is added to the .htaccess file, and the problems start up again. Of note, I have not modified any default settings within Public Key Pinning – I just know that as soon as it’s enabled and saved, the .htaccess file is no longer valid and the site will no longer load.

    FWIW

    Hi,

    We’ve seen similar behaviour on multiple sites. The offending line is:

    Header set Public-Key-Pins “pin-sha256=”$pin”; pin-sha256=”$pinbak”; max-age=31536000″

    ________
    (Fatal – Header has too many arguments)


    Which we’ve found via a tool here: http://www.htaccesscheck.com/

    For many sites, as soon as W3TC is enabled, the local .htaccess is amended with the usual headers/caching settings, but this line causes a 500 error as soon as the site is refreshed. If the offending line is removed, but the plugin remains active, a refresh of any page will re-insert it, causing the 500 error again. Removing the plugin completely, taking out all references of W3TC within the .htaccess restores site functionality. However, once the plugin is re-installed and activated, the issue re-appears. We’re still trying to find commonality on the sites where this occurs.

    Of note one cannot go into Browser Cache/General settings of the plugin to try to disable individual options, because as soon as the plugin is enabled, the offending .htaccess line will cause a 500 error on any page visit within the site.

    @vmarko

Viewing 4 replies - 1 through 4 (of 4 total)