500 internal server error after activation

[ncic]

hi i was trying to install roots theme and i pressed save changes in the activation dialog and now i can't access neither the admin or the site. i get the server error 500. not sure whats happening but maybe it has something to do with my wp being installed in a subfolder. unfortunately I'm not so good with the code stuff, i was trying to learn by installing roots. can someone help me out? site: http://narancicgrafika.com/ncic/ I'm using wordpress 3.4

thanks

[ncic]

i moved my htaccess to a folder that way disabling it and now i get access to my site again. something in there is not compatible with my wp install or something.

[retlehs]

Please share the contents of your .htaccess file. Do you have access to your server logs to see what the error is in there?

Sent from my iPhone

On Jun 13, 2012, at 5:37 PM, ncic reply@reply.github.com wrote:

hi i was trying to install roots theme and i pressed save changes in the activation dialog and now i can't access neither the admin or the site. i get the server error 500. not sure whats happening but maybe it has something to do with my wp being installed in a subfolder. unfortunately I'm not so good with the code stuff, i was trying to learn by installing roots. can someone help me out? site: http://narancicgrafika.com/ncic/ I'm using wordpress 3.4

thanks

---

Reply to this email directly or view it on GitHub: https://github.com/retlehs/roots/issues/475

[ncic]

thanks for your reply shall i just copy paste my access file here? i tried to reactivate and regenerate a new htaccess file and its now in the narancicgrafika.com/ncic directory again but it looks a bit different from the first one the old htaccess file is in the directory narancicgrafika.com/ncic/htaccess/.htaccess can you look at it there from the browser?

also server error logs, where do i find them, in phpmyadmin? i can go there if thats where they are

here is the new one copy pasted

BEGIN HTML5 Boilerplate

This contains the HTML5 Boilerplate .htaccess that can be found at:

github.com/h5bp/html5-boilerplate/blob/master/.htaccess

Added:

Block access to access to WordPress files that reveal version information.

Commented out by default:

Expires headers: Use WP Super Cache or W3 Total Cache (unless using the H5BP build script)

ETag removal: Use WP Super Cache or W3 Total Cache (unless using the H5BP build script)

Start rewrite engine: Handled by WordPress

Suppress/force www: Handled by WordPress

Options -MultiViews: Causes a server 500 error on most shared hosts

Custom 404 page: Handled by WordPress

Anytime you update this file the .htaccess file in the root of your

WordPress install is automatically updated with the changes whenever

the permalinks are flushed or set

----------------------------------------------------------------------

Better website experience for IE users

----------------------------------------------------------------------

Force the latest IE version, in various cases when it may fall back to IE7 mode

github.com/rails/rails/commit/123eb25#commitcomment-118920

Use ChromeFrame if it's installed for a better experience for the poor IE folk

Header set X-UA-Compatible "IE=Edge,chrome=1" # mod_headers can't match by content-type, but we don't want to send this header on _everything_... Header unset X-UA-Compatible

----------------------------------------------------------------------

Cross-domain AJAX requests

----------------------------------------------------------------------

Serve cross-domain Ajax requests, disabled by default.

enable-cors.org

code.google.com/p/html5security/wiki/CrossOriginRequestSecurity

Header set Access-Control-Allow-Origin "*"

----------------------------------------------------------------------

CORS-enabled images (@crossorigin)

----------------------------------------------------------------------

Send CORS headers if browsers request them; enabled by default for images.

developer.mozilla.org/en/CORS_Enabled_Image

blog.chromium.org/2011/07/using-cross-domain-images-in-webgl-and.html

hacks.mozilla.org/2011/11/using-cors-to-load-webgl-textures-from-cross-domain-images/

wiki.mozilla.org/Security/Reviews/crossoriginAttribute

# mod_headers, y u no match by Content-Type?! SetEnvIf Origin ":" IS_CORS Header set Access-Control-Allow-Origin "*" env=IS_CORS

----------------------------------------------------------------------

Webfont access

----------------------------------------------------------------------

Allow access from all domains for webfonts.

Alternatively you could only whitelist your

subdomains like "subdomain.example.com".

Header set Access-Control-Allow-Origin "*"

----------------------------------------------------------------------

Proper MIME type for all files

----------------------------------------------------------------------

JavaScript

Normalize to standard type (it's sniffed in IE anyways)

tools.ietf.org/html/rfc4329#section-7.2

AddType application/javascript js jsonp AddType application/json json

Audio

AddType audio/ogg oga ogg AddType audio/mp4 m4a f4a f4b

Video

AddType video/ogg ogv AddType video/mp4 mp4 m4v f4v f4p AddType video/webm webm AddType video/x-flv flv

SVG

Required for svg webfonts on iPad

twitter.com/FontSquirrel/status/14855840545

AddType image/svg+xml svg svgz AddEncoding gzip svgz

Webfonts

AddType application/vnd.ms-fontobject eot AddType application/x-font-ttf ttf ttc AddType font/opentype otf AddType application/x-font-woff woff

Assorted types

AddType image/x-icon ico AddType image/webp webp AddType text/cache-manifest appcache manifest AddType text/x-component htc AddType application/xml rss atom xml rdf AddType application/x-chrome-extension crx AddType application/x-opera-extension oex AddType application/x-xpinstall xpi AddType application/octet-stream safariextz AddType application/x-web-app-manifest+json webapp AddType text/x-vcard vcf AddType application/x-shockwave-flash swf

----------------------------------------------------------------------

Allow concatenation from within specific js and css files

----------------------------------------------------------------------

e.g. Inside of script.combined.js you could have

and they would be included into this single file.

This is not in use in the boilerplate as it stands. You may

choose to name your files in this way for this advantage or

concatenate and minify them manually.

Disabled by default.

<FilesMatch ".combined.js$">

Options +Includes

AddOutputFilterByType INCLUDES application/javascript application/json

SetOutputFilter INCLUDES

<FilesMatch ".combined.css$">

Options +Includes

AddOutputFilterByType INCLUDES text/css

SetOutputFilter INCLUDES

----------------------------------------------------------------------

Gzip compression

----------------------------------------------------------------------

# Force deflate for mangled headers developer.yahoo.com/blogs/ydn/posts/2010/12/pushing-beyond-gzipping/ SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s_,?\s_)+|[X~-]{4,13}$ HAVE_Accept-Encoding RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding # HTML, TXT, CSS, JavaScript, JSON, XML, HTC: FilterDeclare COMPRESS FilterProvider COMPRESS DEFLATE resp=Content-Type $text/html FilterProvider COMPRESS DEFLATE resp=Content-Type $text/css FilterProvider COMPRESS DEFLATE resp=Content-Type $text/plain FilterProvider COMPRESS DEFLATE resp=Content-Type $text/xml FilterProvider COMPRESS DEFLATE resp=Content-Type $text/x-component FilterProvider COMPRESS DEFLATE resp=Content-Type $application/javascript FilterProvider COMPRESS DEFLATE resp=Content-Type $application/json FilterProvider COMPRESS DEFLATE resp=Content-Type $application/xml FilterProvider COMPRESS DEFLATE resp=Content-Type $application/xhtml+xml FilterProvider COMPRESS DEFLATE resp=Content-Type $application/rss+xml FilterProvider COMPRESS DEFLATE resp=Content-Type $application/atom+xml FilterProvider COMPRESS DEFLATE resp=Content-Type $application/vnd.ms-fontobject FilterProvider COMPRESS DEFLATE resp=Content-Type $image/svg+xml FilterProvider COMPRESS DEFLATE resp=Content-Type $image/x-icon FilterProvider COMPRESS DEFLATE resp=Content-Type $application/x-font-ttf FilterProvider COMPRESS DEFLATE resp=Content-Type $font/opentype FilterChain COMPRESS FilterProtocol COMPRESS DEFLATE change=yes;byteranges=no # Legacy versions of Apache AddOutputFilterByType DEFLATE text/html text/plain text/css application/json AddOutputFilterByType DEFLATE application/javascript AddOutputFilterByType DEFLATE text/xml application/xml text/x-component AddOutputFilterByType DEFLATE application/xhtml+xml application/rss+xml application/atom+xml AddOutputFilterByType DEFLATE image/x-icon image/svg+xml application/vnd.ms-fontobject application/x-font-ttf font/opentype

----------------------------------------------------------------------

Expires headers (for better cache control)

----------------------------------------------------------------------

These are pretty far-future expires headers.

They assume you control versioning with filename-based cache busting

Additionally, consider that outdated proxies may miscache

www.stevesouders.com/blog/2008/08/23/revving-filenames-dont-use-querystring/

If you don't use filenames to version, lower the CSS and JS to something like

"access plus 1 week" or so.

ExpiresActive on

Perhaps better to whitelist expires rules? Perhaps.

ExpiresDefault "access plus 1 month"

cache.appcache needs re-requests in FF 3.6 (thanks Remy ~Introducing HTML5)

ExpiresByType text/cache-manifest "access plus 0 seconds"

Your document html

ExpiresByType text/html "access plus 0 seconds"

Data

ExpiresByType text/xml "access plus 0 seconds"

ExpiresByType application/xml "access plus 0 seconds"

ExpiresByType application/json "access plus 0 seconds"

Feed

ExpiresByType application/rss+xml "access plus 1 hour"

ExpiresByType application/atom+xml "access plus 1 hour"

Favicon (cannot be renamed)

ExpiresByType image/x-icon "access plus 1 week"

Media: images, video, audio

ExpiresByType image/gif "access plus 1 month"

ExpiresByType image/png "access plus 1 month"

ExpiresByType image/jpg "access plus 1 month"

ExpiresByType image/jpeg "access plus 1 month"

ExpiresByType video/ogg "access plus 1 month"

ExpiresByType audio/ogg "access plus 1 month"

ExpiresByType video/mp4 "access plus 1 month"

ExpiresByType video/webm "access plus 1 month"

HTC files (css3pie)

ExpiresByType text/x-component "access plus 1 month"

Webfonts

ExpiresByType application/x-font-ttf "access plus 1 month"

ExpiresByType font/opentype "access plus 1 month"

ExpiresByType application/x-font-woff "access plus 1 month"

ExpiresByType image/svg+xml "access plus 1 month"

ExpiresByType application/vnd.ms-fontobject "access plus 1 month"

CSS and JavaScript

ExpiresByType text/css "access plus 1 year"

ExpiresByType application/javascript "access plus 1 year"

----------------------------------------------------------------------

Prevent mobile network providers from modifying your site

----------------------------------------------------------------------

The following header prevents modification of your code over 3G on some European providers

This is the official 'bypass' suggested by O2 in the UK

Header set Cache-Control "no-transform"

----------------------------------------------------------------------

ETag removal

----------------------------------------------------------------------

FileETag None is not enough for every server.

Header unset ETag

Since we're sending far-future expires, we don't need ETags for

static content.

developer.yahoo.com/performance/rules.html#etags

FileETag None

----------------------------------------------------------------------

Stop screen flicker in IE on CSS rollovers

----------------------------------------------------------------------

The following directives stop screen flicker in IE on CSS rollovers - in

combination with the "ExpiresByType" rules for images (see above). If

needed, un-comment the following rules.

BrowserMatch "MSIE" brokenvary=1

BrowserMatch "Mozilla/4.[0-9]{2}" brokenvary=1

BrowserMatch "Opera" !brokenvary

SetEnvIf brokenvary 1 force-no-vary

----------------------------------------------------------------------

Set Keep-Alive Header

----------------------------------------------------------------------

Keep-Alive allows the server to send multiple requests through one TCP-connection.

Be aware of possible disadvantages of this setting. Turn on if you serve a lot of

static content.

Header set Connection Keep-Alive

----------------------------------------------------------------------

Cookie setting from iframes

----------------------------------------------------------------------

Allow cookies to be set from iframes (for IE only)

If needed, uncomment and specify a path or regex in the Location directive

Header set P3P "policyref=\"/w3c/p3p.xml\", CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\""

----------------------------------------------------------------------

Start rewrite engine

----------------------------------------------------------------------

Turning on the rewrite engine is necessary for the following rules and features.

FollowSymLinks must be enabled for this to work.

#

Some cloud hosting services require RewriteBase to be set: goo.gl/HOcPN

If using the h5bp in a subdirectory, use RewriteBase /foo instead where 'foo' is your directory.

Options +FollowSymlinks

RewriteEngine On

RewriteBase /

----------------------------------------------------------------------

Suppress or force the "www." at the beginning of URLs

----------------------------------------------------------------------

The same content should never be available under two different URLs - especially not with and

without "www." at the beginning, since this can cause SEO problems (duplicate content).

That's why you should choose one of the alternatives and redirect the other one.

By default option 1 (no "www.") is activated. Remember: Shorter URLs are sexier.

no-www.org/faq.php?q=class_b

If you rather want to use option 2, just comment out all option 1 lines

and uncomment option 2.

IMPORTANT: NEVER USE BOTH RULES AT THE SAME TIME!

----------------------------------------------------------------------

Option 1:

Rewrite "www.example.com -> example.com"

RewriteCond %{HTTPS} !=on

RewriteCond %{HTTP_HOST} ^www.(.+)$ [NC]

RewriteRule ^ http://%1%{REQUEST_URI} [R=301,L]

----------------------------------------------------------------------

Option 2:

To rewrite "example.com -> www.example.com" uncomment the following lines.

Be aware that the following rule might not be a good idea if you

use "real" subdomains for certain parts of your website.

RewriteCond %{HTTPS} !=on

RewriteCond %{HTTP_HOST} !^www..+$ [NC]

RewriteRule ^ http://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

----------------------------------------------------------------------

Built-in filename-based cache busting

----------------------------------------------------------------------

If you're not using the build script to manage your filename version revving,

you might want to consider enabling this, which will route requests for

/css/style.20110203.css to /css/style.css

To understand why this is important and a better idea than all.css?v1231,

read: github.com/h5bp/html5-boilerplate/wiki/cachebusting

Uncomment to enable.

RewriteCond %{REQUEST_FILENAME} !-f

RewriteCond %{REQUEST_FILENAME} !-d

RewriteRule ^(.+).(\d+).(js|css|png|jpg|gif)$ $1.$3 [L]

----------------------------------------------------------------------

Prevent SSL cert warnings

----------------------------------------------------------------------

Rewrite secure requests properly to prevent SSL cert warnings, e.g. prevent

https://www.example.com when your cert only allows https://secure.example.com

Uncomment the following lines to use this feature.

RewriteCond %{SERVER_PORT} !^443

RewriteRule ^ https://example-domain-please-change-me.com%{REQUEST_URI} [R=301,L]

----------------------------------------------------------------------

Prevent 404 errors for non-existing redirected folders

----------------------------------------------------------------------

without -MultiViews, Apache will give a 404 for a rewrite if a folder of the same name does not exist

e.g. /blog/hello : webmasterworld.com/apache/3808792.htm

Options -MultiViews

----------------------------------------------------------------------

Custom 404 page

----------------------------------------------------------------------

You can add custom pages to handle 500 or 403 pretty easily, if you like.

If you are hosting your site in subdirectory, adjust this accordingly

e.g. ErrorDocument 404 /subdir/404.html

ErrorDocument 404 /404.html

----------------------------------------------------------------------

UTF-8 encoding

----------------------------------------------------------------------

Use UTF-8 encoding for anything served text/plain or text/html

AddDefaultCharset utf-8

Force UTF-8 for a number of file formats

AddCharset utf-8 .css .js .xml .json .rss .atom

----------------------------------------------------------------------

A little more security

----------------------------------------------------------------------

Do we want to advertise the exact version number of Apache we're running?

Probably not.

This can only be enabled if used in httpd.conf - It will not work in .htaccess

ServerTokens Prod

"-Indexes" will have Apache block users from browsing folders without a default document

Usually you should leave this activated, because you shouldn't allow everybody to surf through

every folder on your server (which includes rather private places like CMS system folders).

Options -Indexes

Block access to "hidden" directories or files whose names begin with a period. This

includes directories used by version control systems such as Subversion or Git.

RewriteCond %{SCRIPT_FILENAME} -d [OR] RewriteCond %{SCRIPT_FILENAME} -f RewriteRule "(^|/)." - [F]

Block access to backup and source files

This files may be left by some text/html editors and

pose a great security danger, when someone can access them

<FilesMatch "(.(bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist)|~)$"> Order allow,deny Deny from all Satisfy All

Block access to WordPress files that reveal version information.

<FilesMatch "^(wp-config.php|readme.html|license.txt)"> Order allow,deny Deny from all Satisfy All

If your server is not already configured as such, the following directive

should be uncommented in order to set PHP's register_globals option to OFF.

This closes a major security hole that is abused by most XSS (cross-site

scripting) attacks. For more information: http://php.net/register_globals

#

IF REGISTER_GLOBALS DIRECTIVE CAUSES 500 INTERNAL SERVER ERRORS :

#

Your server does not allow PHP directives to be set via .htaccess. In that

case you must make this change in your php.ini file instead. If you are

using a commercial web host, contact the administrators for assistance in

doing this. Not all servers allow local php.ini files, and they should

include all PHP configurations (not just this one), or you will effectively

reset everything to PHP defaults. Consult www.php.net for more detailed

information about setting PHP directives.

php_flag register_globals Off

Rename session cookie to something else, than PHPSESSID

php_value session.name sid

Disable magic quotes (This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0.)

php_flag magic_quotes_gpc Off

Do not show you are using PHP

Note: Move this line to php.ini since it won't work in .htaccess

php_flag expose_php Off

Level of log detail - log all errors

php_value error_reporting -1

Write errors to log file

php_flag log_errors On

Do not display errors in browser (production - Off, development - On)

php_flag display_errors Off

Do not display startup errors (production - Off, development - On)

php_flag display_startup_errors Off

Format errors in plain text

Note: Leave this setting 'On' for xdebug's var_dump() output

php_flag html_errors Off

Show multiple occurrence of error

php_flag ignore_repeated_errors Off

Show same errors from different sources

php_flag ignore_repeated_source Off

Size limit for error messages

php_value log_errors_max_len 1024

Don't precede error with string (doesn't accept empty string, use whitespace if you need)

php_value error_prepend_string " "

Don't prepend to error (doesn't accept empty string, use whitespace if you need)

php_value error_append_string " "

Increase cookie security

php_value session.cookie_httponly true

END HTML5 Boilerplate

BEGIN WordPress

RewriteEngine On RewriteBase /ncic/ RewriteRule ^index.php$ - [L] RewriteRule ^css/(._) /ncic/wp-content/themes/retlehs-roots-e16aa0e/css/$1 [QSA,L] RewriteRule ^js/(._) /ncic/wp-content/themes/retlehs-roots-e16aa0e/js/$1 [QSA,L] RewriteRule ^img/(._) /ncic/wp-content/themes/retlehs-roots-e16aa0e/img/$1 [QSA,L] RewriteRule ^plugins/(._) /ncic/wp-content/plugins/$1 [QSA,L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /ncic/index.php [L]

END WordPress

[ncic]

wow sorry for the formatting mess

[ncic]

i put the contents of the generated htaccess files in textfiles you can view here

http://www.narancicgrafika.com/ncic/htaccess/htCurrent.txt http://www.narancicgrafika.com/ncic/htaccess/htOldFirst.txt

[expertpixels]

Can't actually access your files you pasted above "Internal Server Error" when trying to view them..

Do you have a .htaccess file in your root dir ? narancicgrafika.com <-- you may have one there that is conflicting,

I am not a fan (don't have much luck ) running wp from subfolders.. i suggest that you created a addon-domain and use ncic.narancicgrafika.com instead just a thought.

[hariadi]

You can't use both rule at the same time to suppress/force "www". Please choose either Option 1 or Option 2.

[ncic]

hey guys thanks for the pointers @expertpixels i moved my site to root and tried to enable the theme but the server error happened again. sorry here are the files again http://www.narancicgrafika.com/ncic/htCurrent.txt http://www.narancicgrafika.com/ncic/htOldFirst.txt

@hariadi thank you but sorry i don't understand i will look in the access files to see if i can connect what you write to something in there

[expertpixels]

Try my .htaccess file (NOTE* ive edited it to reflect your website / sub-folder install: narancicgrafika.com/ncic/ )

http://pastebin.com/xtL2FWqb

copy and replace your current .htaccess file with my above code i uploaded to pastebin.. again place this here: narancicgrafika.com/ncic/

Keep us updated, good luck.

Regards, Darren

[retlehs]

do you have access to your apache error logs?

[retlehs]

also, comment out this line in config.php:

add_theme_support('h5bp-htaccess');

then delete your .htaccess and try again

[retlehs]

closing until this is proven to be an actual bug. if it works without the h5bp access it might be the latest additions to that file, see 0ed246ec558385484e4e92327801a5e61153be33 and try reverting those changes/using a previous version such as https://github.com/retlehs/roots/blob/fc9f001d96b20a9dba507b1c80f824d39d5645b9/inc/h5bp-htaccess

[matthewjhunt]

Using Wordpress 3.4 and a copy of the roots theme I cloned yesterday, My .htaccess file is not being created properly. The only thing written to the file is:

BEGIN WordPress

RewriteEngine On RewriteBase /~mh/wordpress-roots/ RewriteRule ^index.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /~mh/wordpress-roots/index.php [L]

END WordPress

So the paths to all the js, css, images, and plugins do not work. None of the boilerplate settings are written to the file.

[oscar-g]

Here is a line from the error log

[Wed Jan 06 09:42:22 2016] [error] [client (retracted)] PHP Parse error: syntax error, unexpected '[' in /var/www/wordpress/wp-content/themes/sage-8.4.0/functions.php on line 12

Most likely related to #1490