Forbidden

I am finding that, in order for this plugin to continue to function post-upgrade, you must remember to create an .htaccess file for it in the following folder: wordpress/wp-content/plugins/pdfjs-viewer-shortcode/pdfjs/web/.htaccess Inside this .htaccess file: # Allow direct access to PDF viewer PHP file. # This is required for embedded PDFs to display. # This rule will superceed the security rule above # defined in /wp-content/.htaccess that blocks # direct access to PHP files. <Files viewer.php> allow from all </Files> Then make sure Apache owns the file: sudo chown apache:apache ./.htaccess If you don’t remember to do this, you’ll get a PDF Forbidden error after you’ve upgraded. Maybe this .htaccess file can become part of the upgrade payload? I’m guessing that has more to do with your specific server setup, but I can look into it. I do not recall ever setting anything in my root .htaccess file regarding this, but I’m betting the security plugin we use here (Wordfence) did. If you were to put that plugin-specific .htaccess file in this plugin’s codebase, though, no harm done? And it would solve a previously vexing issue for other folks who may run into the Forbidden message? And yet, related: https://wordpress.org/support/topic/security-compatibility-concern-plugin-is-calling-php-files-directly/ Did you figure this out? With thousands of installs, no one has had .htaccess issues. In that case, I guess it was idiosyncratic to my local setup. (I’m betting my Wordfence was blocking it, somehow…)