I am running (for a client) a Wordpress site on a CentOS/WHM/Apache 2.2 server, and within a subdirectory we have AWStats installed. Everything working fine until we apply password protection through the htaccess file. With password protection in place, it results in a 404 error when attempting to view the AWStats.
After a lot of trial and error, we discovered that it's down to the Wordpress htaccess rules.
Adjusting them with the following:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
# The following line is the line we added
RewriteCond %{REQUEST_URI} ^wp-content/stats(.*)
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
(AWStats was installed in a subfolder of wp-content as this results in the fewest issues with Wordpress)
Which worked fine, until a Wordpress automatic update erased all changes and restored this htaccess block to default. Making this change and removing the # Begin/End Wordpress markers results in 500 Errors all over the place when the next Wordpress update occurs as it simply adds another one of these blocks.
Everything I have tried seems to not work.
What I have tried:
Adding the htaccess rewrite condition with a write-to-self rule separately, both prior to and after the Wordpress segment. This results in the 404 problem.
Adding the htaccess rewrite condition with a write-to-self rule in an htaccess file within the AWStats directory. This results in the 404 problem.
Adding an htaccess file within the AWStats directory with the directive; RewriteEngine Off. This results in the 404 problem.
Creating a subdomain for the AWStats directory. This just results in a configuration error within AWStats (that I can't seem to fix, so for someone who understand the configuration settings of AWStats better than I might be able to use this solution).
Removing password protection. Not ideal, this site is already the target of Wordpress comment spammers, referrer spammers, and every other PITA who wants to abuse a poor defenceless Wordpress website.
I would like to resolve this without granting the client access to cPanel, as they want several people to have access to the stats data in the AWStats (yes, we do also have Analytics installed on the site, the client wants AWStats as well) who shouldn't have access to everything that cPanel would give them.
Does anyone have a suggestion or experience in resolving this particular issue?