Invalid line in .htaccess after a plugin update: HTTP 500 on every page
What the site owner saw
A security plugin update wrote a line into .htaccess that Apache does not recognize. Every page, including the login page, returned HTTP 500, and the Apache error log showed "Invalid command".
Source (public forum thread): https://wordpress.org/support/topic/server-error-after-updating-to-1-5-5-quick-fix-and-update-to-1-5-6/
Test setup and what we observed after the failure
Test site: WordPress 7.1, PHP 8.3. The table shows the HTTP status of the homepage and the login page after the recipe recreated the failure.
| Server setup | Homepage | Login page | Note |
|---|---|---|---|
| Apache + PHP-FPM | 500 | 500 | Apache error log: Invalid command. |
| nginx + PHP-FPM | 200 | 200 | nginx does not read .htaccess; the failure does not occur on this setup, so no run was made here. |
Outcome of each run
| Date (UTC) | Server setup | Connection mode | Outcome | Product version | Note |
|---|---|---|---|---|---|
| 2026-11-06 | Apache + PHP-FPM | SSH | Recovered | 2.1.434 | The recovery removed the one unrecognized line and kept the other rules. |
| 2026-11-06 | Apache + PHP-FPM | FTP | Declined at the pre-payment check | 2.1.434 | First FTP attempt; see gaps. |
| 2026-11-06 | Apache + PHP-FPM | FTP | Recovered | 2.1.434 | Second FTP attempt after the change below. |
| 2026-11-06 | Apache + PHP-FPM | SSH | Recovered | 2.1.435 | Re-test after later changes shipped. |
Gaps and the version that fixed them
Every run that did not end in "recovered" is listed here: what we changed, the version it shipped in, and the re-test date and outcome.
| Found | Server setup | Connection mode | What we changed | Fixed in | Re-test |
|---|---|---|---|---|---|
| 2026-11-05 | Apache + PHP-FPM | SSH | The pre-payment check declined a site that returned HTTP 500 on every page, which is the state the site owner reports. The check now accepts a site in this state. | 2.1.434 | 2026-11-06 · Recovered |
| 2026-11-06 | Apache + PHP-FPM | FTP | On an FTP server that hides dot-files from directory listings, the check treated .htaccess as missing. The check now sees hidden files. | 2.1.434 | 2026-11-06 · Recovered |
Problem types this case covers
Notes
The first attempt, on 2026-11-05 over SSH, was declined at the pre-payment check (first row in the gaps table). The product version of that attempt was not recorded, so it is not listed as a run.
These are records from our test servers, for a given product version on a given day. They are not a promise about the result on any site. Other hosts, PHP versions, and WordPress versions can behave differently.