Invalid line in .htaccess after a plugin update: HTTP 500 on every page

配方 20261105-htaccess-bad-waf-block · 最新一跑 2026-11-06 · 首次發布 2026-11-09 · 更新 2026-11-09 · Forum case

站主看到什麼

A security plugin update wrote a line into .htaccess that Apache does not recognize. Every page, including the login page, returned HTTP 500, and the Apache error log showed "Invalid command".

出處（公開論壇帖）: https://wordpress.org/support/topic/server-error-after-updating-to-1-5-5-quick-fix-and-update-to-1-5-6/

測試環境與弄壞後看到什麼

測試站：WordPress 7.1、PHP 8.3。下表是照配方弄壞之後，首頁與登入頁回的 HTTP 狀態。

主機環境	首頁	登入頁	備註
Apache + PHP-FPM	500	500	Apache error log: Invalid command.
nginx + PHP-FPM	200	200	nginx does not read .htaccess; the failure does not occur on this setup, so no run was made here.

每一跑的結局

日期（UTC）	主機環境	連線模式	結局	維修站版本	備註
2026-11-06	Apache + PHP-FPM	SSH	Recovered	`2.1.434`	The recovery removed the one unrecognized line and kept the other rules.
2026-11-06	Apache + PHP-FPM	FTP	Declined at the pre-payment check	`2.1.434`	First FTP attempt; see gaps.
2026-11-06	Apache + PHP-FPM	FTP	Recovered	`2.1.434`	Second FTP attempt after the change below.
2026-11-06	Apache + PHP-FPM	SSH	Recovered	`2.1.435`	Re-test after later changes shipped.

缺口與修在哪一版

結局不是修好的跑次，都在這裡：改了什麼、修在哪一版、重跑的日期與結局。

發現日	主機環境	連線模式	改了什麼	修在哪一版	重跑
2026-11-05	Apache + PHP-FPM	SSH	The pre-payment check declined a site that returned HTTP 500 on every page, which is the state the site owner reports. The check now accepts a site in this state.	`2.1.434`	2026-11-06 · Recovered
2026-11-06	Apache + PHP-FPM	FTP	On an FTP server that hides dot-files from directory listings, the check treated .htaccess as missing. The check now sees hidden files.	`2.1.434`	2026-11-06 · Recovered

對到的故障項目

.htaccess 損壞 (404/500)

補充

The first attempt, on 2026-11-05 over SSH, was declined at the pre-payment check (first row in the gaps table). The product version of that attempt was not recorded, so it is not listed as a run.

這些是我們測試主機上、某一版、某一天的紀錄，不是對任何網站結果的承諾；其他主機、PHP 與 WordPress 版本的結果可能不同。