smackfoo.com | I find your lack of faith disturbing.

I’ve found a quick hack to fix the secure directory issue in wp 2.x. It involves a two step process that solves the issue temporarily..

This has been a nuisance for many a wordpress user, creating mayhem and aggrivation due to wordpress helpfully attempting to turn any valid URI into a permalink. In my opinion, this functionality is very cool. What’s not cool, is the distinct lack of control over what actually should constitute a valid wordpress URI and what is in actual fact a valid secured directory.

Thus, I present a quick-and-dirty process to side-step the aggresive wordpress rules, with a little .htaccess magic.

As we know, the ‘default’ wordpress 2.x .htaccess looks like the following:

# BEGIN WordPress
< IfModule mod_rewrite.c >
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
< / IfModule >
`# END WordPress`

What we’re going to do, is insert three rules to trigger the equivelent of the old fashioned BREAK command many older programing languages used and force wordpress to ignore a specific directory. In this example, we’re going to stop wordpress processing the /stats/ directory as though it forms part of a permalink.

The three lines are thus written:

RewriteCond %{REQUEST_URI} ^/stats/(.*)$ [OR]
`RewriteCond %{REQUEST_URI} ^/failed_auth.html$`
`RewriteRule ^.*$ - [L]`

The secret here, is that we have to “break” the wordpress generated rules while they are being processed, not before, as that won’t acheive anything. Like any ‘loop’ one needs to ‘interupt’ it, not operate outside of it. So, the above three lines are inserted into the default .htaccess file, like so:

# BEGIN WordPress
< IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
`RewriteCond %{REQUEST_URI} ^/stats/(.*)$ [OR]`
RewriteCond %{REQUEST_URI} ^/failed_auth.html$
RewriteRule ^.*$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
< / IfModule>
`# END WordPress`

The logic here basically is:
IF directory match is TRUE do not rewrite ELSE process WP internal rules.

Give it a spin. You can of course, add additional directories by duplicating the line:

`RewriteCond %{REQUEST_URI} ^/some_directory/(.*)$ [OR]`

.. edited to match any directories you may need.

The last step, is to change the permissions on your wordpress .htaccess file, for example:

chmod 755 .htaccess

..to remove the ability for wordpress to update it on the fly. WP will simply spit out any changes need in .htaccess as required and they can either be added manually, or your existing directory exlusion rules backed up and re-added to the re-generated .htaccess file.

This last step is most useful as it returns control of .htaccess, back to the user. I can certainly see a use for a plugin that can ‘inject’ exclusions such as the above into Wordpress and indeed have a few ideas on the boil.