2

I’m using Cloudflare nameservers and tried to whitelist Cloudflare IPs through htaccess file, but it results in a 403 Forbidden error for my Wordpress login.

Here are the directives I used in htaccess file:

# Apache 2.2: Whitelist Cloudflare IPs
<IfModule !authz_core_module>
Order Allow,Deny
Allow from 173.245.48.0/20
Allow from 103.21.244.0/22
Allow from 103.22.200.0/22
Allow from 103.31.4.0/22
Allow from 141.101.64.0/18
Allow from 108.162.192.0/18
Allow from 190.93.240.0/20
Allow from 188.114.96.0/20
Allow from 197.234.240.0/22
Allow from 198.41.128.0/17
Allow from 162.158.0.0/15
Allow from 104.16.0.0/12
Allow from 172.64.0.0/13
Allow from 131.0.72.0/22
</IfModule>
# Apache 2.4+: Whitelist Cloudflare IPs
<IfModule authz_core_module>
<RequireAll>
Require ip 173.245.48.0/20
Require ip 103.21.244.0/22
Require ip 103.22.200.0/22
Require ip 103.31.4.0/22
Require ip 141.101.64.0/18
Require ip 108.162.192.0/18
Require ip 190.93.240.0/20
Require ip 188.114.96.0/20
Require ip 197.234.240.0/22
Require ip 198.41.128.0/17
Require ip 162.158.0.0/15
Require ip 104.16.0.0/12
Require ip 172.64.0.0/13
Require ip 131.0.72.0/22
</RequireAll>
</IfModule>

This blocked me from login in Wordpress, so I tried to add this along with the above directives:

<Files wp-login.php>
<IfModule mod_authz_core.c>
Require all granted
</IfModule>
<IfModule !mod_authz_core.c>
Order Allow,Deny
Allow from all
</IfModule>
</Files>

But this didn’t work!

What can I do, please, to resolve this issue?

  • Have you tried disabling the authz_core_module altogether? Usually once you have a CDN, there is no need for such a module on the origin server. – Stephen Ostermiller Feb 21 at 17:22
  • OK, @StephenOstermiller; I'll try to disable the authz_core_module and let you know of the result. As for the greetings and thanks, I'll try next time to be less polite as much as I can :-) – Horizon19 Feb 23 at 13:14
1

This blocked me from login in ...

I would have expected this to have blocked your entire site, not just the login?

<RequireAll>
Require ip 173.245.48.0/20
Require ip 103.21.244.0/22
Require ip 103.22.200.0/22
Require ip 103.31.4.0/22
:
</RequireAll>

Only 1 IP will access at any one time, so most of these Require ip directives will fail, so the <RequireAll> directive will fail and access will be blocked.

It should be <RequireAny> instead. Or omitted altogether (since that is the default).

| improve this answer | |
  • I will try to change the <RequireAll> to <RequireAny> and see what it does. I'll let you know for any result. – Horizon19 Feb 23 at 13:18
  • I used <RequireAny> but access to wp-admin was still forbidden. I deleted it, but same result. I tried to delete all the block related to Apache 2.2, but same result. Then, I deleted the block related to Apache 2.4, and it worked! But, my server information in cPanel indicates that it has Apache 2.4+; so I'm not sure if I should keep only the Apache 2.2 directives!!... Should I check with the hosting provider!!? – Horizon19 Feb 24 at 9:36
  • "I deleted the block related to Apache 2.4, and it worked!" - Doesn't that indicate that your server IS Apache 2.4? Is it only the wp_admin section that is blocked; not the entire site? If so, then that would seem to indicate something else is blocking you? (Unless you are only putting these directives in the wp_admin subdirectory?!) Check your server's access log and the IP address that is being blocked - is this included in the stated IP ranges? (The Apache 2.2 block won't do anything on Apache 2.4 because the directives are in an <IfModule !authz_core_module> container.) – MrWhite Feb 24 at 10:51
  • - Yes; I can confirm from cPanel that the server is Apache 2.4. - wp-admin section is the only one that is blocked when using the above whitelisting Cloudflare IPs method. - The htaccess file used is the one at the root of the domain (not just in the wp-admin subdirectory). – Horizon19 Feb 25 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.