Knowledge Base

Unable to edit posts or use plugin dashboard in WordPress dashboard after applying security measures by Plesk WP Toolkit

Symptoms

The security measure Security of the wp-content folder is applied for the WordPress instance at Domains > example.com> WordPress > select a WordPress instance in question > Security Status (Check Security in older WP Toolkit versions).
When using a 3rd-party editor (e.g. TinyMCE Advanced or Elementor) in WordPress dashboard, the editor’s interface is not fully loaded or it is not possible to edit posts. The following error is thrown in a browser:

PLESK_INFO: Forbidden
You don’t have permission to access /web/wp-includes/js/tinymce/wp-tinymce.php on this server.

In some cases, the “403 Forbidden nginx” error is shown after clicking Update/Publish/etc.

One of the following error messages appears:

in the domain’s proxy_error_log file /var/www/vhosts/example.com/logs/proxy_error_log:

[error] 23560#0: *5116 access forbidden by rule, client: 203.0.113.2, server: example.com, request: "GET /wp-includes/js/tinymce/wp-tinymce.php?c=1&ver=4607-20171116-tadv-4.6.7 HTTP/2.0", host: "example.com", referrer: "https://example.com/wp-admin/post.php?post=198&action=edit"

in the domain’s error_log file /var/www/vhosts/system/example.com/logs/error_log:

[error] [client 203.0.113.2] client denied by server configuration: /var/www/vhosts/example.com/web/wp-includes/js/tinymce/wp-tinymce.php
 [error] [client 203.0.113.2] client denied by server configuration: /var/www/vhosts/example.com/web/wp-includes/js/tinymce/wp-tinymce.php

Cause

This is a WP Toolkit bug with ID EXTWPTOOLK-1102 which was fixed in the WP Toolkit 3.5.0 version

Resolution

Update WP Toolkit extension to the latest version.

In case update is not possible, apply one of the following solutions:

Workaround 1: Exclude the sub-directory /wp-content/plugins/

Log in to Plesk
Go to Domains > example.com > Apache & nginx settings and add the following directives to the Additional nginx directives field:
```
location ~* wp-config.php { deny all; }
 location ~* "^/wp-content/(?!plugins/).*.php" { deny all; }
```
Check if the issue has gone. If plugin operability is still broken, revert the changes and apply the solution below.

Workaround 2: Revert the security measure

Log in to Plesk
Go to Domains > example.com > WordPress > select a WordPress instance in question > Security Status (Check Security in older WP Toolkit versions).
Select Security of the wp-content folder and click Revert (Roll Back in older WP Toolkit versions).

Note: If a WordPress plugin still fails to work correctly, additionally revert the security measure Security of the wp-includes folder.