title: 403 Forbidden error when using mod_rewrite with WordPress
body: <p>I am using this .htaccess directives to prevent SQL injection attacks to my WordPress blog:</p>
  
  <pre><code>&lt;IfModule mod_rewrite.c&gt;
  RewriteEngine On
  RewriteBase /
  RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC]
  RewriteRule ^(.*)$ - [F,L]
  RewriteCond %{QUERY_STRING} \.\.\/ [NC,OR]
  RewriteCond %{QUERY_STRING} boot\.ini [NC,OR]
  RewriteCond %{QUERY_STRING} tag\= [NC,OR]
  RewriteCond %{QUERY_STRING} ftp\:  [NC,OR]
  RewriteCond %{QUERY_STRING} http\:  [NC,OR]
  RewriteCond %{QUERY_STRING} https\:  [NC,OR]
  RewriteCond %{QUERY_STRING} (\&lt;|%3C).*script.*(\&gt;|%3E) [NC,OR]
  RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|%3D) [NC,OR]
  RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]
  RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|&lt;|&gt;|ê|"|;|\?|\*|=$).* [NC,OR]
  RewriteCond %{QUERY_STRING} ^.*(&amp;#x22;|&amp;#x27;|&amp;#x3C;|&amp;#x3E;|&amp;#x5C;|&amp;#x7B;|&amp;#x7C;).* [NC,OR]
  RewriteCond %{QUERY_STRING} ^.*(%24&amp;x).* [NC,OR]
  RewriteCond %{QUERY_STRING} ^.*(%0|%A|%B|%C|%D|%E|%F|127\.0).* [NC,OR]
  RewriteCond %{QUERY_STRING} ^.*(globals|encode|localhost|loopback).* [NC,OR]
  RewriteCond %{QUERY_STRING} ^.*(request|select|insert|union|declare).* [NC]
  RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in_.*$
  RewriteRule ^(.*)$ - [F,L]
  &lt;/IfModule&gt;
  </code></pre>
  
  <p>My blog uses a JavaScript redirection to redirect the visitor from an opening page to the blog with the following query string parameters: <code>redir=1&amp;ref=</code> </p>
  
  <p>So the "ref" parameter is usually empty if the visitor comes from no referral set, for example he typed the title in the browser. In other cases the "ref" parameter has a value which shows for me where the visitor is coming from.</p>
  
  <p>My problem is that at first visit I get a 403 error message:</p>
  
  <pre><code>Forbidden
  
  You don't have permission to access / on this server.
  
  Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.
  </code></pre>
  
  <p>After removing the abovementioned directives from the .htaccess the problem also disappears. However I would like to use a modified version of these directives to prevent SQL injection attacks. What lines should I modify to prevent the attacks and get rid of the "403 forbidden" error message?</p>