XMLHTTPRequest cannot load URL_HERE due to access control checks

I’m still not sure what the problem is or what to do about it.
Anyone got an idea what the issue so I can accurately search for a solution?

You know, understanding the problem is half the solution and that sort of thing…

Thanks!

@arnandegans Took a look at your robots.txt file and it shows:

User-agent: *
Disallow: /cgi-bin/
Disallow: /license.txt
Disallow: /readme.html
allow: /

Sitemap: http://mototravel.net/sitemap.xml

Should be something like:

User-agent: *
Disallow: /wp-admin/
Allow: /wp-admin/admin-ajax.php

Sitemap: https://mototravel.net/sitemap.xml

Notice the https

Don’t know if this is even relevant, but may be something to look into. Your Disallow entries are not needed.

Could this possibly be a modsecurity issue?

I don’t know - I guess that’s what I’m asking you guys.
If I google the error I find all kinds of stuff for iOS apps and http/post requests, but nothing useful that applies to WordPress/ClassicPress and some talk about ‘symfony’ being outdated. Whatever that means.

If you have cPanel access, you should be able to turn off ModSecurity in order to try your update again. If it works with ModSec off, you should first turn it back on, then contact your webhost to see if they can tweak it so you can still have ModSec protection while also being able to save edits.

In any case, this seems to me to be a hosting environment issue, rather than a CP issue.

Its a VPS I have cPanel and WHM root access.
I’ll look for the option.

I too am not convinced its a CP issue, but my webhost is less than helpful. They barely answer tickets…

Found it, disabled it for all domains, waited a few seconds and tried to save my post a few times.
Still not working.

Can it be a firewall thing? And if so, how do I check that?
As far as I know, aside from regular updates to cPanel, that’s the only thing that got messed with in the past 6 months.

If it was ModSec issue, it would have made an immediate difference.
Could be a firewall issue; it definitely has to do with security.
Sorry I don’t have the expertise to be more helpful.

Seems to be a browser issue involving a javascript conflict. Have you seen this?

Yes, @viktor mentioned this a few replies ago.
All seems fine on that end, and the same settings (.htaccess) on a different VPS with CP work fine.

But yes, I did find a few posts about that. Wholly unfamiliar with CORS and what that’s supposed to do and stuff though.
These directives look a bit different - I’ll give it a read, maybe I’ll learn something.

Still, to my mind, these tweaks shouldn’t be nessesary to save a post when everything else works fine.
Especially since saving anything also worked fine a few weeks ago. I made the site after-all :wink:

Here is something new… I can save pages and products, but not posts.

:expressionless::man_shrugging:

I did some more testing.

If I click save on a page it does it instantly. Same for a Classic Commerce product.
Of-course as an automatism I picked the top (newest) post to save and resave. And that does NOT work.

However, other (older) and new posts, also save.

So ONE post does not save. Fine, idiosyncrasy of the browser right?

I copy the contents, which is just a bunch of text and a shortcode.
Put it in a new post, delete the original. And now the new post doesn’t work.

I’ve tried this in Safari and Firefox.

Firefox is a bit more informative. I did find out that if I let it run for a while that after 5 seconds the post does save through load-scripts.php invoking admin-ajax. Fine. But the response is broken. If I leave it running it tries 3 times 15 seconds apart according to Firefox.

Then It fails on a internal server error.

Which shows this:

[09-Jul-2022 00:03:02 UTC] PHP Fatal error: Maximum execution time of 30 seconds exceeded in /path/to/domains/mototravel.net/wp-includes/cache.php on line 536

I don’t use any caching on the site, no plugins. This is the built-in object cache.

stumped

During this road of discovery I did figure out that ENABLE_CACHE in wp-config.php doesn’t work anymore aparently. So I removed that. I also found a thing that caches into APCu, which I added.
Seems to work - No errors, but that one f*cking post still won’t safe.

Oh, and yes, I did delete all history and cached data from Firefox during all this too. No change.

You can’t make this up really…

If it’s affecting posts but not pages, that makes me think permalinks might be the issue. Which sort are you using? Try re-saving them.

Custom: /%post_id%/%postname%/

I don’t want the date in the url really, so Google can’t ‘date’ the content based on it.

I doubt that’s the issue, then, though I don’t understand why you don’t just use postname

The id makes it so that the url is unique - So posts with the same name can happen.
Not sure if that’s really necessary yet…

It’s not necessary, as CP will just add -2 (or -3, or whatever) to the URL if that happens. On news sites, lots of posts have the same title. It’s not an issue at all.

Hmm - Never thought of that.
But, it doesn’t solve the issue.

Logically it’s not a server issue nor a CP issue as the same code works for other posts/pages to save and respond.
Other than perhaps a stupid firewall or some adaptive policy thing for security. But I can’t find such a thing.
Several browsers with or without cached pages doing this also (mostly) rule out a browser issue…

And it makes less sense now than this morning :frowning:

I think you have to do the disable plugins trick and see what happens then. As you site’s live, ideally you’d want to do this on a staging or localhost site. I’d start with the SSL plugin.

I’ve tried all that today. Also dug through the database, meta data, stuff like that looking for weird stuff.
Nothing.
I also don’t really have the patience/energy to continue looking for now. Maybe one day I’ll figure it out… Stupid internet… :expressionless:

Thanks for everyone their input and thoughtful responses. If I learn something new I’ll update the topic.

@timkaye I did change the permalinks as you suggested, looks a lot cleaner :partying_face:

1 Like