Here at Bobcares, our Support Engineers provide tech support to VPS providers, Cloud hosters, and other online service proiders.

We help VPS users resolve their server and web application issues by functioning as the tech support of our customers (the service providers).

In the line of our work, a common error we see in WordPress sites hosted on Apache servers is client denied by server configuration. 

Here’s a quick note about the top 5 reasons for this error, and how we fix it.

What is “client denied by server configuration”?

A a site visitor requests a page, the web server Apache tries to fetch it for the person.

But first, it’ll look through all the configuration files to make sure all security and user rules are followed.

If any of these rules prevent the access of a requested page, this error is shown.

Now, let’s take a look at the reasons:

1. Resource limits

All VPS providers put limits on CPU and Memory based on the plan a customer chooses.

The operating system images are also made to fit this server limit.

We’ve seen VPSs with 128 MB PHP execution limits. This can easily get exhausted in a WordPress site when the traffic increases.

To find out if this is a resource related error, look at the error logs for something like this:

PHP: Fatal Error: Allowed Memory Size of 134217728 Bytes Exhausted

or

Resource Limit Is Reached

How to fix resource limit issues

The most obvious solution to this is to upgrade the memory (or the resource that was limited), but don’t do that just yet.

We’ve seen many cases where un-wanted plugins or poorly scheduled backup processes caused resource errors.

When we see a resource limite issue, we break down the memory usage into the top 10 users (or services).

Then we figure out if those can be disabled or re-scheduled. For eg. backup scripts can be run when the site traffic is low (at night).

If not, we send the site owner the list of plugins that’s consuming the most memory, and ask them to see if all of them are needed.

If none of these solutions work, we upgrade the server resources to resolve the issue.

2. App or Server firewall restrictions

Many websites use security tools such as Web Application Firewalls (eg. mod_security), WordPress security plugins, Server firewalls (eg. CSF), etc.

These tools have a wide range of security settings that range from location based blocking to request signature based blocking.

Any of these rules can cause a visitor request to be denied.

Some of the more common issues we’ve seen are:

• PHP execution restrictions – Considering that most malware use path traveral and “exec” commands to cause harm, many firewalls block requests that contain these commands. But in rare cases it can result in legitimate plugins to also be blocked.
• Paranoid web app firewall rules – Some untested firewall rules in mod_security is known to cause request blocking.
• IP blacklisting – If the site owner’s IP or a visitor’s IP is listed in a DNS Block List (as it usually happens), the site will appear down to them.

How to fix firewall restrictions

Again your friend is the Apache error log and the firewall log. Look for entries like this:

ModSecurity: Access denied with code 403

It will usually give you a pretty clear picture of which rule is causing the request to fail.

When we see a security error like this, we fist disable that rule to see if that error vanishes.

If it does, we either create a visitor specific white list, or – if the rule affects everyone, we disable that specific rule.

3. Apache security settings

With all the popular security tools out there, you’d think Apache is pretty helpless on it’s own.

Not so, it has some teeth too, enough to cause trouble for all of us.

By default, many Linux distros configure Apache to prevent access to configuration files such as .htaccess, php.ini, etc.

In addition, the latest Apache 2.4 replaced some of its configuration variable with new ones, causing old configuration files to return this error.

How to fix Apache security settings

If you are fairly certain that it is an Apache error, look at the confiuration files for restrictions based on these:

• IP
• File location
• Proxy pass

Look for recently changed entries or those that have complex rules. Try disabling those.

IMPORTANT : If you are not sure what these entries are, it is best to consult an expert. In fact, our Apache experts are online right now. Click here to submit a support request.

4. File path configuration errors

These days we can install WordPress in so many different ways that people tend to forget what is installed where.

We’ve seen cases where people try to access WordPress in /opt drive when it is actually installed in /var/users/.

Now think about not providing the required permissions for the folders.

All these can contribute to file path errors, that’ll result in client denied by server configuration.

How to fix path configuration error

When faced with a file path error, we start with the WordPress directory.

We check if Apache is allowed to access the directories and files inside the WordPress folder.

The we check Apache’s various configuration files that includes .htaccess, account level vhost, site specific vhosts and server configuration files to see if there are conflicting entries that’s leading Apache to the wrong directory.

By crossing out each possibility systematically in this way, you can resolve this issue in a few minutes.

5. Administration software bug

Many website owners use administration tools such as cPanel, DirectAdmin, etc.

In some rare cases, we’ve seen instances of these tools creating Apache configuration files with incorrect entries.

So, if no other reason seems to fit the case, you may want to contact a Linux Support Technician to troubleshoot the issue from top to bottom.

Our Linux experts are online 24/7. Click here to open a support request, and we can help you in minutes.

Summary

There are a hundred different causes for the error “client denied by server configuration” in WordPress sites hosted on Apache servers. We’ve today seen the top 5 reasons for it, and how to fix it.