PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteIf Akismet reports Order not allowed here in WordPress, Apache is reading an Order directive from .htaccess but the document root’s AllowOverride policy does not permit that directive class. The usual repair is to add Limit to the relevant Apache <Directory> block—for example, AllowOverride FileInfo Limit—then test the configuration and reload Apache. On Apache 2.4, migrating the rule to Require is the preferred long-term approach.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Do not solve this by enabling AllowOverride All everywhere. Apply the narrowest change to the directory that contains this WordPress installation, and involve your hosting provider if you cannot edit the server’s Apache configuration.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What “Order not allowed here” means
Apache processes directives in .htaccess only when the server administrator has enabled the corresponding override class for that directory. The legacy access-control directives Order, Allow, and Deny belong to the Limit override class. If the site permits only FileInfo, Apache rejects an Order line before WordPress or Akismet can use it.
A typical restrictive block looks like this:
<Directory "/var/www/example.com/public_html">
AllowOverride FileInfo
</Directory>That setting allows directives in the FileInfo class but not legacy authorization rules. Adding Limit to the same block allows those older directives:
#1 Best Overall
<Directory "/var/www/example.com/public_html">
AllowOverride FileInfo Limit
</Directory>The path must be the actual filesystem directory containing the WordPress files. An AllowOverride directive in a <Location> or <Files> section will not provide the required permission; Apache documents AllowOverride for <Directory> context.
Why Akismet can expose the problem
A plugin or an installation change can place an access-control rule in the site’s .htaccess file. If that rule contains Order, Apache evaluates it under the legacy Limit class. A host that previously allowed the rule, or a server migration that changed the virtual-host policy, can therefore turn the same file into an error after an update.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe exact Akismet template and the Apache build differ between sites. The reliable diagnostic is the Apache error itself: find the Order line named in the log or the browser’s 500 response, then compare it with the AllowOverride value for the WordPress document root. Do not assume that every .htaccess line came from Akismet; inspect the file and the surrounding rules before editing.
Check the site safely before editing
Back up both configuration layers
Save a copy of the affected .htaccess file and the Apache virtual-host configuration before making changes. Keep the backup outside the web root and preserve the original permissions. If a change causes a syntax error or an unintended access rule, restoring the prior files gives you a known recovery point.
Confirm which Apache instance serves the site
On servers with several virtual hosts, a different Apache instance, container, or proxy may serve the hostname than the one you first inspect. Verify that the virtual host handling the WordPress domain points to the same document-root path shown in the error and that you are editing the active configuration rather than an unused template.
Record the current failure
Note the requested URL, the timestamp, and the exact Apache log message. A line such as order not allowed here identifies an override-policy problem. A message about a missing module, malformed syntax, or a denied filesystem permission requires a different repair and should not be “fixed” by changing AllowOverride.
Repair a legacy rule with a narrowly scoped override
- Locate the active
<Directory>block. Find the block whose path covers the WordPress document root, such as/var/www/example.com/public_html. Check included virtual-host files as well as the main Apache configuration. - Inspect the existing override value. If it is
AllowOverride FileInfo, theLimitclass is missing. If it isAllowOverride None, all.htaccessoverrides are disabled and the host must decide whether this site should use them. - Add only the required class. For a file that intentionally uses
Order,Allow, orDeny, use a value such as:
<Directory "/var/www/example.com/public_html">
AllowOverride FileInfo Limit
</Directory>- Do not broaden the setting unnecessarily. Avoid
AllowOverride Allin the filesystem root or globally. A broad setting lets any permitted.htaccessfile enable more directive classes than this site needs. - Check the resulting
.htaccess. Confirm that the legacy rule is complete and that unrelated directives were not deleted. If the rule blocks or allows a particular IP or host, make sure its scope still matches the intended directory.
The change belongs in Apache’s server or virtual-host configuration, not in the .htaccess file itself. .htaccess can request directives only after the server administrator has authorized their override class.
Test the configuration before reloading Apache
Run a syntax check after saving the server configuration:
apachectl configtestOn systems where the alternate form is used, run:
apachectl -tApache documents these checks as configuration tests that report syntax problems without starting the server: Apache HTTP Server configuration documentation. Continue only when the command reports that the syntax is valid. A failed test usually identifies a line number; correct that error and test again instead of reloading a known-bad configuration.
Once the test succeeds, reload or restart Apache using the service procedure for that operating system or hosting environment. Then request the affected WordPress URL and watch the Apache error log. A successful repair removes the order not allowed here message. If the page still returns a 500 response, use the new log entry rather than assuming the original override problem is unchanged.
Modernize the rule on Apache 2.4
Order, Allow, and Deny are legacy directives supplied by mod_access_compat and are deprecated in Apache 2.4. Apache’s current authorization system uses Require. For example, a rule that permits every client can be expressed as:
Require all grantedIP- and host-based restrictions use the corresponding modern forms, such as:
Require ip 203.0.113.24
Require host example.netThe exact replacement depends on what the old rule was intended to do. Translate the policy, not merely the words: an old combination of Order, Allow, and Deny can express precedence that is not preserved by copying one line to Require.
Do not mix authorization systems casually
Apache provides mod_access_compat so older configurations can continue to run, but its documentation discourages mixing compatibility directives with Require rules in the same access-control logic. Choose one model for a given rule set unless you understand Apache’s merging behavior and have tested the result. A partial conversion can accidentally grant or deny requests that the old configuration handled differently.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →When modernization is the better fix
- Use a
Require-based rule when the server is Apache 2.4 and you can safely express the intended policy. - Use
AllowOverride FileInfo Limitas a compatibility repair when the existing.htaccessdepends on legacy syntax and changing it is outside your current maintenance window. - Ask the host to perform the conversion when the relevant file is generated by a plugin or managed platform and you cannot guarantee that a manual edit will persist.
Choose the fix that fits your server
| Situation | Practical fix | Trade-off |
|---|---|---|
Apache configuration is under your control and the file intentionally uses Order |
Add Limit to the matching document-root <Directory> block, commonly AllowOverride FileInfo Limit. |
Preserves the legacy rule but continues using deprecated authorization syntax. |
| Apache 2.4 and the rule can be rewritten accurately | Replace the old access logic with Require directives and test the resulting policy. |
Requires careful translation and testing; do not combine both systems casually. |
Shared or managed hosting with no <Directory> access |
Ask the provider to enable the Limit override class for the document root or convert the rule to Require. |
Resolution depends on the provider’s change window and security policy. |
| The site does not need legacy access control at all | Remove or replace the obsolete rule after confirming which component created it. | Deleting it without understanding its purpose can remove a protection or change site behavior. |
| A server-wide configuration is being considered only to silence one error | Do not use global AllowOverride All; scope the smallest required change to the affected directory. |
A narrow change takes more investigation but limits the authority granted to .htaccess. |
If you cannot edit Apache configuration
On shared hosting, the <Directory> block is normally controlled by the provider. Send support the domain, document-root path, exact error text, and the relevant .htaccess lines. Request one of two specific actions: enable the Limit override class for that document root, or convert the legacy access rule to an equivalent Apache 2.4 Require rule.
Do not ask for an unrestricted global override as a first response. Apache’s override controls are intended to limit what files below a directory can change. A provider may instead require the rule to move into the virtual-host configuration, which is appropriate when the host does not permit access-control directives in customer-level .htaccess files.
Troubleshooting after the first fix
The same “order not allowed here” message remains
- Confirm that the edited
<Directory>path exactly covers the document root serving the domain. - Check for a later or more specific
<Directory>block overriding the value you changed. - Verify that Apache was reloaded after a successful syntax test and that a proxy or container is not serving an older configuration.
- Search all included configuration files for another
AllowOverridesetting applied to the same path.
The syntax test fails after adding Limit
Inspect the reported line for quoting, braces, and spelling. The value must appear inside a valid <Directory> section. Do not place AllowOverride in <Location> or <Files>; that placement does not authorize the .htaccess directive.
The error changes to a different 500 response
Read the newest error-log entry. Once Apache accepts Order, it may reveal an unrelated malformed directive, a missing module, a filesystem permission issue, or a problem in another part of .htaccess. Fix one reported cause at a time and rerun the configuration test after server-level edits.
Free tools Windows power users keep installed
One-click scans. No signup required.
Changing .htaccess has no effect
The host may have AllowOverride None, may use a different document root, or may have disabled .htaccess processing for performance or security reasons. In that case, editing the file cannot change Apache behavior; the rule must be removed, relocated, or installed by the administrator in the virtual-host configuration.
Security checks before declaring success
- Review whether the rule is intended to allow all clients, deny a list, or restrict access by IP or host. A syntactically valid conversion can still implement the wrong policy.
- Keep the override scope limited to the WordPress directory that needs it.
- After reloading, test both the previously failing WordPress URL and a URL that should remain protected.
- Check the log for unexpected authorization results, not just the disappearance of the original error.
- Document whether the site remains on
mod_access_compator has moved toRequire, so a future plugin update or migration does not reintroduce mixed syntax.
What to retain for future migrations
The error is an Apache policy mismatch, not an Akismet setting that can be corrected from the WordPress dashboard. Order, Allow, and Deny require the legacy Limit override class; AllowOverride FileInfo alone is insufficient. The durable process is to identify the correct document-root block, make the smallest permitted change, run apachectl configtest or apachectl -t, reload Apache, and verify the result in the log. For Apache 2.4, convert the rule to Require when you can preserve its intended authorization behavior.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
