multisite - Uncaught Error: Interface '...' not found for direct acces to wp-includes files

I went through my web server logs and found a few internal errors that I would like to fix. Note that the website itself is working perfectly fine, i.e., a normal user won't notice any difference. I just see in my log that regularly (every few days) an internal error 500 occurs. I assume this is caused by automatic bot scans, but I would still like to address this properly.

When accessing the URL:

.php

For the following URIs:

• /wp-includes/Requests/src/Proxy/Http.php
• /wp-includes/html-api/html5-named-character-references.php (and any other file in html-api)
• /wp-includes/Requests/src/Auth/Basic.php

Causes an error that looks like this (in /var/log/apache2/error.log):

[Thu Jan 02 15:12:18.866235 2025] [php7:error] [pid 754932] [client XXX] PHP Fatal error:  Uncaught Error: Interface 'WpOrg\\Requests\\Proxy' not found in /var/www/html/wp-includes/Requests/src/Proxy/Http.php:24\nStack trace:\n#0 {main}\n  thrown in /var/www/html/wp-includes/Requests/src/Proxy/Http.php on line 24
[Thu Jan 02 15:12:20.611898 2025] [php7:error] [pid 754907] [client XXX] PHP Fatal error:  Uncaught Error: Class 'WP_Token_Map' not found in /var/www/html/wp-includes/html-api/html5-named-character-references.php:38\nStack trace:\n#0 {main}\n  thrown in /var/www/html/wp-includes/html-api/html5-named-character-references.php on line 38

The files are all present and have the same content as a fresh Wordpress install (but I still tried completely reinstalling Wordpress as noted below)

About my Setup

I am using multisite. Everything else is rarely basic. Some other internal errors could be fixed by using the updated .htaccess from here, but the ones above stayed.

What I have tried already

I did all of the following and checked the pages after each modification, but

1. Deactivate all plugins (in wp-admin)
2. Activate default theme (twentytwentyfive)
3. Stop the web server
4. Backup all files
5. Backup Database
6. Remove all files except wp-content/
7. Reinstall WordPress (sudo -u www-data wp core download --force --skip-content)
8. Add minimal .htaccess
9. Generate new wp-config.php: sudo -u www-data wp config create ...
10. Update wp-config.php with old settings. (Enable multisite)
11. Start webserver
12. Test

--> The errors still occurred as before

Current Workaround

Adding the following block to my main .htaccess replaces the error by a 403 Forbidden. However, I would like to know if there is a better way to address this than blocking direct access to the file.

########################################
# Block direct access to includes folder
########################################
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=5]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
RewriteRule ^wp-includes/Requests/.*\.php$ - [F,L]
RewriteRule ^wp-includes/html-api/.*$ - [F,L]
</IfModule>

I.e., is blocking direct access to the files causing the errors the best solution and doesn't produce any other problems, or is there a better way to deal with this?

I went through my web server logs and found a few internal errors that I would like to fix. Note that the website itself is working perfectly fine, i.e., a normal user won't notice any difference. I just see in my log that regularly (every few days) an internal error 500 occurs. I assume this is caused by automatic bot scans, but I would still like to address this properly.

When accessing the URL:

https://mydomain.com/wp-includes/Requests/src/Proxy/Http.php

For the following URIs:

• /wp-includes/Requests/src/Proxy/Http.php
• /wp-includes/html-api/html5-named-character-references.php (and any other file in html-api)
• /wp-includes/Requests/src/Auth/Basic.php

Causes an error that looks like this (in /var/log/apache2/error.log):

[Thu Jan 02 15:12:18.866235 2025] [php7:error] [pid 754932] [client XXX] PHP Fatal error:  Uncaught Error: Interface 'WpOrg\\Requests\\Proxy' not found in /var/www/html/wp-includes/Requests/src/Proxy/Http.php:24\nStack trace:\n#0 {main}\n  thrown in /var/www/html/wp-includes/Requests/src/Proxy/Http.php on line 24
[Thu Jan 02 15:12:20.611898 2025] [php7:error] [pid 754907] [client XXX] PHP Fatal error:  Uncaught Error: Class 'WP_Token_Map' not found in /var/www/html/wp-includes/html-api/html5-named-character-references.php:38\nStack trace:\n#0 {main}\n  thrown in /var/www/html/wp-includes/html-api/html5-named-character-references.php on line 38

The files are all present and have the same content as a fresh Wordpress install (but I still tried completely reinstalling Wordpress as noted below)

About my Setup

I am using multisite. Everything else is rarely basic. Some other internal errors could be fixed by using the updated .htaccess from here, but the ones above stayed.

What I have tried already

I did all of the following and checked the pages after each modification, but

1. Deactivate all plugins (in wp-admin)
2. Activate default theme (twentytwentyfive)
3. Stop the web server
4. Backup all files
5. Backup Database
6. Remove all files except wp-content/
7. Reinstall WordPress (sudo -u www-data wp core download --force --skip-content)
8. Add minimal .htaccess
9. Generate new wp-config.php: sudo -u www-data wp config create ...
10. Update wp-config.php with old settings. (Enable multisite)
11. Start webserver
12. Test

--> The errors still occurred as before

Current Workaround

Adding the following block to my main .htaccess replaces the error by a 403 Forbidden. However, I would like to know if there is a better way to address this than blocking direct access to the file.

########################################
# Block direct access to includes folder
########################################
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=5]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
RewriteRule ^wp-includes/Requests/.*\.php$ - [F,L]
RewriteRule ^wp-includes/html-api/.*$ - [F,L]
</IfModule>

I.e., is blocking direct access to the files causing the errors the best solution and doesn't produce any other problems, or is there a better way to deal with this?

• multisite
• fatal-error
• 500-internal-error

Share Improve this question asked Jan 2 at 4:17 ErikErik 111 bronze badge New contributor Erik is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 0

Blocking access to things that should never be directly accessed is always the best solution.