[bitnami/wordpress] Redirect IP access to domain

[jnayak01]

Name and Version

bitnami/wordpress 6.2.2

What architecture are you using?

None

What steps will reproduce the bug?

1. In the browser, type https://XX.XX.XX.XX
2. 1. In the browser, type https://XX.XX.XX.XX

I can provide the original IP address over

Are you using any custom parameters or values?

No response

What is the expected behavior?

Redirect all attempts to access the website's public IP (XX.XX.XX.XX) over to the domain.

What do you see instead?

The IP via HTTPS is still accessible, and accessing any random location (like https://ip/non-existing-file/) shows a 404 but it does not redirect to the domain.
If you access just the IP, without any subdirectory, it does not redirect you to the domain.

Additional information

Hello, I'm working on Wordpress website hosted in AWS Lightsail with a Bitnami package.

I'd like to redirect all attempts to access the website's public IP (XX.XX.XX.XX) over to the domain. Basically, when a user or attacker tries to access https://xx.xx.xx.xx/home or https://xx.xx.xx.xx/some-page/ or http://xx.xx.xx.xx/ we'd like to force-redirect them to https://www.mydomain.com/home or https://www.mydomain.com/some-page/ or https://www.mydomain.com/ correspondingly.

So far, none of the solutions we've researched online have helped me.
The IP via HTTPS is still accessible, and accessing any random location (like https://ip/non-existing-file/) shows a 404 but it does not point to the domain.
If you access just the IP, without any subdirectory, it does not redirect you to the domain.

We are using the Bitnami HTTPS configuration tool (bncert) to enable HTTPS on our Certified by Bitnami WordPress instance on Amazon Lightsail (ref- https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-enabling-https-on-wordpress ). We followed the steps in the article to enable HTTP to HTTPS redirection and non-www to www redirection. Also we referred the following article to redirect All Domains To Your Own Domain And Force HTTPS - https://docs.bitnami.com/aws/apps/wordpress/administration/use-single-domain/

If you access the website via domain name, the redirections happen properly.

CURRENT INCORRECT BEHAVIOUR WE SEE

• Allows website access via IP , and If you access the website via IP, the redirection to HTTPS happens but shows 'Certificate is not valid'.
• Allows website access via IP , and If you access the website via IP, the redirection from non-www to www does not happen.

Summary - I want to restrict any access to the website via IP , instead redirect IP access through domain

[gongomgra]

Hi @jnayak01,

Thanks for using Bitnami. Can you run the bndiagnostic tool and share the generated code with us so we can check your Apache configuration?

https://docs.bitnami.com/general/how-to/understand-bndiagnostic/

[jnayak01]

Hi @gongomgra ,
Thank you for your response. Please see the code below -
e41ca7f1-7174-cd8e-a99e-789390ca76fc

[gongomgra]

Hi @jnayak01,

Thanks for sharing the info. I reviewed the Apache config and I think I know what can be happening.

First of all, we highly encourage you to create a server backup before modifying any config file so you can easily restore your current status

https://docs.bitnami.com/aws/faq/administration/backup-restore-server/

Regarding your Apache config, I don't see anywhere the configuration related to our section for 'redirect all domains to your own domain and force HTTPS'. The current configuration you have only redirects requests which already include a domain name. Can you add the new redirect section after the current configuration and then restart Apache service for changes to take effect?

https://docs.bitnami.com/aws/apps/wordpress/administration/use-single-domain/#redirect-all-domains-to-your-own-domain-and-force-https

You can restart Apache by running the next command

sudo /opt/bitnami/ctlscript.sh restart apache

[jnayak01]

Hi @gongomgra ,

Following the instruction in the link you provided, I added the redirect section and restarted Apache, but it did not work.

1. Added the following configuration into the /opt/bitnami/apache/conf/bitnami/bitnami.conf file.
   <VirtualHost _default_:80> RewriteEngine On RewriteCond %{HTTP_HOST} !^(localhost|127.0.0.1) RewriteRule ^(.*)$ https://mydomain.com$1 [R=permanent,L]

2. Added the following configuration into the /opt/bitnami/apache/conf/bitnami/bitnami-ssl.conf file
   <VirtualHost _default_:443> RewriteEngine On RewriteCond %{HTTP_HOST} !^mydomain.com$ RewriteCond %{HTTP_HOST} !^(localhost|127.0.0.1) RewriteRule ^(.*)$ https://mydomain.com$1 [R=permanent,L]

3. Added the following configuration into any virtual host file located in the /opt/bitnami/apache/conf/vhosts/ directory.
   <VirtualHost 127.0.0.1:80 _default_:80> RewriteEngine On RewriteCond %{HTTP_HOST} !^mydomain.com$ RewriteCond %{HTTP_HOST} !^(localhost|127.0.0.1) RewriteRule ^(.*)$ https://mydomain.com$1 [R=permanent,L]

I ran the diagnostics once more - the code is
8f0f3afa-f9ee-0422-f434-eb50ede1d52b

Do you want to take a look directly at the server conf files ? Please let me know if I am missing anything else here .

[gongomgra]

Hi @jnayak01,

Thanks for the new bndiagnostic code. I checked it and I think the Apache configuration is correct. It is also working for me from the command line

$ curl -LI "3.YOUR-IP.208"
HTTP/1.1 301 Moved Permanently
Date: Tue, 06 Jun 2023 09:56:34 GMT
Server: Apache
Location: https://diYOUR-DOMAINsy.com/
Content-Type: text/html; charset=iso-8859-1

HTTP/1.1 301 Moved Permanently
Date: Tue, 06 Jun 2023 09:56:35 GMT
Server: Apache
Location: https://www.diYOUR-DOMAINsy.com/
Content-Type: text/html; charset=iso-8859-1

HTTP/1.1 200 OK
Date: Tue, 06 Jun 2023 09:56:35 GMT
Server: Apache
Link: <https://www.diYOUR-DOMAINsy.com/wp-json/>; rel="https://api.w.org/", <https://www.diYOUR-DOMAINsy.com/wp-json/wp/v2/pages/298>; rel="alternate"; type="application/json", <https://www.diYOUR-DOMAINsy.com/>; rel=shortlink
Content-Type: text/html; charset=UTF-8

Can you check if your browser is caching the website on your side? I browsed using an incognito window and it worked fine as well.

[jnayak01]

Hi @gongomgra ,

Thank you for your response. I cleared the cache and also tried accessing the website via IP in incognito mode. The HTTP works fine but the issue still persists for HTTPS.

The IP via HTTPS is still accessible, and accessing any random location (like https://ip/non-existing-file/) shows a 404 but it does not redirect to the domain. If you access just the IP via HTTPS, without any subdirectory, it does not redirect you to the domain.
and shows 'Certificate is not valid'.

[jnayak01]

Hi @gongomgra ,
Any idea what the issue is with https redirection ? Any help would be greatly appreciated.

[gongomgra]

Hi @jnayak01,

The issue with the IP address and HTTPS is that the IP address is not covered by the SSL certificate

$ curl -LI "https://3.YOUR-IP.208"
curl: (51) SSL: no alternative certificate subject name matches target host name '3.YOUR-IP.208'

However, when requesting the HTTP version of your website using the IP address, it gets properly redirected

$ curl -LI "3.YOUR-IP.208"
HTTP/1.1 301 Moved Permanently
Date: Tue, 06 Jun 2023 09:56:34 GMT
Server: Apache
Location: https://diYOUR-DOMAINsy.com/
Content-Type: text/html; charset=iso-8859-1

HTTP/1.1 301 Moved Permanently
Date: Tue, 06 Jun 2023 09:56:35 GMT
Server: Apache
Location: https://www.diYOUR-DOMAINsy.com/
Content-Type: text/html; charset=iso-8859-1

HTTP/1.1 200 OK
Date: Tue, 06 Jun 2023 09:56:35 GMT
Server: Apache
Link: <https://www.diYOUR-DOMAINsy.com/wp-json/>; rel="https://api.w.org/", <https://www.diYOUR-DOMAINsy.com/wp-json/wp/v2/pages/298>; rel="alternate"; type="application/json", <https://www.diYOUR-DOMAINsy.com/>; rel=shortlink
Content-Type: text/html; charset=UTF-8

From our experience, the second use case (accessing via HTTP with the IP address) is the most frequent of them. It is not usual accessing an IP address with HTTPS. In case you need to cover that specific use case, you will have to get your server IP address included in the SSL certificate, and also include the Apache configuration to redirect non-domain requests to your domain in the wordpress-https-vhost.conf file.

[github-actions]

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.

[github-actions]

Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Issue. Do not hesitate to reopen it later if necessary.