Ask Regina Smola

There have been some issues recently from peo­ple I know receiv­ing a 403 Error when try­ing to access Word­Press self-hosted websites.

After some research, I col­lected the fol­low­ing infor­ma­tion for you just in case you run into this issue.

This is what the error may look like:

Error 403
We're sorry, but we could not ful­fill your request for / on this server.

You do not have per­mis­sion to access this server. Before try­ing again, run anti-virus and anti-spyware soft­ware and remove any viruses and spy­ware from your computer.

Your tech­ni­cal sup­port key is: 1872-ff63-2b02-1b1f

You can use this key to fix this prob­lem yourself.

If you are unable to fix the prob­lem your­self, please con­tact [SITE OWNER] at [SITE EMAIL] and be sure to pro­vide the tech­ni­cal sup­port key shown above.

What does it mean? Well, here's the answer…

A friend and col­league of mine had a trusted asso­ciate come to her self-hosted Word­Press web­site. How­ever, when open­ing the web­site, the above error was shown instead of the web­site. She was com­pletely unable to see ANY web­page on her site. All she saw was a page with the error above. She con­tacted me to check out why this was happening.

After some thought and dis­abling of some plu­g­ins, I deducted that it was the Bad Behav­ior plu­gin caus­ing this error. Once I dis­abled it, she was able to open the web­site fine. Hmmm, I knew I had to find a solu­tion for her.

I emailed Michael Hamp­ton over at the Bad Behav­ior web­site (Home of the pre­mier link spam killer) and he got back to me right away with the answer.

Here's what he said:

In this case the IP address of your friend's com­puter is on the third-party http:BL black­list to which you sub­scribed when you con­fig­ured Bad Behav­ior. Most likely Rogers has assigned your friend an IP address which was used by another sub­scriber to send spam in the recent past.

You can usu­ally get a new (and hope­fully clean) IP address by reset­ting the cable modem. You can also dis­able or retune the http:BL feature.

Michael Hamp­ton
Author of Bad Behav­ior Plugin

I would per­son­ally like to thank Michael for the won­der­ful sup­port he gave me and his very quick reply.

Be sure to install the Bad Behav­ior plugin!

You can find out more infor­ma­tion and down­load it here

http://www.bad-behavior.ioerror.us/

Now, it all made sense to me. I imme­di­ately went over to Project Honey Pot and entered in her IP address. And WOW, there were many "Bad Behav­iors" com­ing from the same IP address she had. We knew it wasn't her. She lives in a very rural area and her IP is shared by many.

Here's how you search to see if an IP is on the "Bad Behav­ior" list:

1. Go to Project Honey Pot:
   http://www.projecthoneypot.org
2. Click on the "IP Data" tab. This is the Direc­tory of Mali­cious IPs they've collected.
3. Click on the sub-tab "Lookup IP."
4. Type in the IP address you want to look up and hit the search button.Not to per­son­ally tar­get a bad hacker, but as an exam­ple, try search­ing this IP: 93.174.93.58. (Note: This is not the IP of my friend's friend.)

   At this par­tic­u­lar moment there are 70,410 web post sub­mis­sions sent and it's con­sis­tent with a com­ment spam­mer send­ing porn key­words and links to var­i­ous uninvit­ing websites.

In con­clu­sion…

The Bad Behav­ior plu­gin was doing it's job! It was block­ing all these bad hack­ers from access­ing her web­site. It does a fan­tas­tic job and I highly rec­om­mend that you use this plu­gin if you are self-hosting a Word­Press site. Be sure to uti­lize the http:BL Access Key built in too. This is what makes the error mes­sage work and blocks them from access your site.

I just looked at my stats for this very web­site and Bad Behav­ior has blocked  over 794 in the last 7 days.

To the left is a screen shot from my admin panel (click to enlarge) show­ing my cur­rent stats.

I know that my friend's asso­ciate couldn't get on her site, but what about the other mul­ti­tude of bad guys that use that same IP? Do you want to risk that?

If you know some­one that you trust that can't access your web­site, have them try Michael's tip about unplug­ging their modem and restart­ing it. Hope­fully, it will give them a new IP. If not, ask them to con­tact their Inter­net provider, as it's them that assign the IP to them.

Of course, there are ways to whitelist an IP within WP, but I don't rec­om­mend it for some­one that shares an IP, even if you trust them.

What would I do if my IP was blocked?

For me, I would con­tact my IP provider and tell them was was going on. I would also send them the link to look it up at Project Honey Pot so they could see the results of my IP block. Then, I would demand a new IP imme­di­ately. If they didn't com­ply, I would seek a new Inter­net provider or see if I could get a ded­i­cated IP address that is exclu­sively for me.

Hope­fully, they would take mea­sures to get rid of these peo­ple if they were their clients too.

I know it's tough to stop bad hack­ers from doing what they do, but if you have a web­site, you need to take the mea­sure nec­es­sary to try to stop them.

Let me know if you're using the Bad Behav­ior plu­gin and how you like it or if you have a ques­tion about it, leave a com­ment below.

Dis­clo­sure: I am not affil­i­ated with this prod­uct or it's pro­duc­ers. This is only my opinion.

Last 5 posts by Regina Smola

• Word­Press Secu­rity Webi­nar — 6 Things you need to know
• Ho'oponopono TeleWe­b­cast with Mabel Katz and Cyrus Ontiki — Octo­ber 27
• 15 Tips for Word­Press Security
• Free WP Secu­rity Webi­nar on Oct 15
• The Eas­i­est Way to Build New Affil­i­ate Websites