Client denied by server configuration

Domains and Hosting
1

Hello everyone… I’m turning to you today… impossible to find a solution. You’re often a great help to me when I read your posts on other topics, thank you! But I haven’t found anything by digging through the old messages.

Today I’m completely stuck on the site formation‑massage‑drome.fr which shows a critical error (white page). I managed to get the WordPress dashboard on the first login, but when I tried to run my updates I ended up on a white page… In short… likely a hack. Indeed there were two extra admin users (which I deleted) and via FTP I saw a lot of files that shouldn’t be there. I cleaned them up.

Then I tried to update WordPress, the theme and plugins manually via FTP. It did nothing.

I changed my PHP version… it did nothing.

Refreshing shows an Internal Server Error and my latest logs indicate:

[Sat Jul 11 00:14:22 2026] [X-OVHRequest-Id: 317ac9ac129e76628c80b87e1d9c5122] [error] [client 5.135.41.162:0] [host www.formation-massage-drome.fr] AH01797: client denied by server configuration: /homez.434/formatioaw/www/wp-cron.php
[Sat Jul 11 00:17:49 2026] [X-OVHRequest-Id: 21c6b860f5c62118022e036c9680f390] [error] [client 204.12.208.18:0] [host formation-massage-drome.fr] AH10141: FastCGI: comm with server "/homez.434/formatioaw/www/wp-includes/ad9ac11b/edit.php" aborted: idle timeout (160 sec)
[Sat Jul 11 00:17:49 2026] [X-OVHRequest-Id: 21c6b860f5c62118022e036c9680f390] [error] [client 204.12.208.18:0] [host formation-massage-drome.fr] AH10149: FastCGI: incomplete headers (0 bytes) received from server "/homez.434/formatioaw/www/wp-includes/ad9ac11b/edit.php"
[Sat Jul 11 00:35:32 2026] [X-OVHRequest-Id: 226809fd62b198b93e57143c13abf908] [error] [client 5.135.41.162:0] [host www.formation-massage-drome.fr] AH01797: client denied by server configuration: /homez.434/formatioaw/www/wp-cron.php

I have to admit I’m completely stuck. I’m missing something but I don’t know what… If anyone could give me an idea, thanks!!

2

Hello @CAROLINEG10

Switch PHP to a development environment so you can see errors immediately when you connect to the site.

Also install the script bonjour.php, which will allow you to see the exact PHP version that is being used for your site.

https://www.wordetweb.com/word-et-web/WORDPRESS-guide-installation-de-WordPress-premier-domaine-chez-OVH-FR.htm#_I3_–_Contrôle

https://www.wordetweb.com/word-et-web/WORDPRESS-guide-installation-de-WordPress-premier-domaine-chez-OVH-FR.htm#_P2__-

3

Hi @CAROLINEG10

By the way, with the OVH manager, which PHP version do you see?

4

It is highly likely that there are still “remnants” left by your hacker.

wp-includes contains files and directories, but nothing with a cryptic name should be there.

To be safe, you should reinstall everything, unless you have a backup from before the hack.

5

I installed this script yesterday, yes, I saw your post… but there’s nothing I can do—I keep repeatedly landing on the Internal Error page.

6

Thank you so much! Problem solved. Your 'Guide' site is so comprehensive for a lot of things to know. Bravo. I used the hello.php file method. My .htaccess file was corrupted, and many files had also been injected. By downloading a clean WordPress .htaccess via Filezilla, deleting all the corrupted files, and setting the PHP configuration to development, I was able to see the errors. Problem solved!

7

Indeed, hacking! Solved now! Thanks for taking the time to reply to my message.

8

Hello @CAROLINEG10

Now that your WordPress site is up and running:

  • Download the profile sheet from my guide and update it.

  • Change all your passwords to all different and long passwords for: WordPress admin, database and FTP.

  • Deactivate and delete all plugins that are not essential.

  • It may be through one of these plugins that you were hacked.

9

Hello @CAROLINEG10

Now that your WordPress site is operational:

Backups of your site at OVH are not permanent.

Excerpt from my guide: T - OVH restoration of your site to an earlier date

At OVH, restoring your hosting can only go back a maximum of two weeks.

If the hack of your site dates back three weeks, you’re screwed and forced to delete everything and completely rebuild your site.

At OVH, restoring your database can only go back a maximum of two months

Remember to make a backup Hosting and Database on your PC once a month.
See in my guide the paragraph: Ua - Full backup of your site to your PC

See in my guide the paragraph: Ub - Full restoration of your site from your PC