Skip Navigation

This thread is resolved. Here is a description of the problem and solution.

Problem:
The client is trying to add a translation to a blog post using the WordPress Editor, but the translated blog post is not automatically connected to the original English post and exists as a separate entity unless manually connected.

Solution:
The problem turned out to be because of NGINX security headers that they added recently to improve the website security. Specifically these two:

add_header Referrer-Policy "strict-origin";
add_header Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self)";

Removing these headers fixed the issue.

If the problem continues, please visit our support forum and open a new ticket for further assistance. We also highly recommend checking related known issues at https://wpml.org/known-issues/, verifying the version of the permanent fix, and confirming that you have installed the latest versions of themes and plugins.

If this solution does not apply to your case because it might be outdated or not relevant, please do not hesitate to contact us by opening a new support ticket at our support forum.

This is the technical support forum for WPML - the multilingual WordPress plugin.

Everyone can read, but only WPML clients can post here. WPML team is replying on the forum 6 days per week, 22 hours per day.

Tagged: 

This topic contains 16 replies, has 2 voices.

Last updated by Waqas Bin Hasan 4 months ago.

Assisted by: Waqas Bin Hasan.

Author Posts
August 8, 2024 at 6:13 am

federicoB-41

Background of the issue:
I am trying to add a translation to a blog post using WordPress Editor.

Symptoms:
The translated blog post is not connected automatically and exists as a separate blog post in a different language unless manually connected to the original English post.

Questions:
Why is the translation not automatically linked to the original blog post?
How can I ensure that the translation is automatically connected to the original blog post?

August 8, 2024 at 6:59 am
August 8, 2024 at 12:00 pm #16052499

Waqas Bin Hasan
Supporter

Languages: English (English )

Timezone: Asia/Karachi (GMT+05:00)

Hi,

Thank you for contacting the support.

I see that you're using previous versions of WPML while the latest WordPress. I'll recommend to fix and try the following:

IMPORTANT: Please take full backup of your website and database beforehand. 

It is highly advised to try this on a staging/dev site first, so your live website isn't compromised.

- Update WPML plugins to the latest versions.
- Update all other plugins specially the ones involved in the said process, to the latest versions.
- Update theme to the latest version if needed.

Then:

- Clear all caches and check again.
- If issue is still there, then please try to delete the translation of the page first by following steps (https://wpml.org/faq/how-to-delete-the-translation-of-a-page/):
--- Go to Pages, in default language.
--- Switch to a secondary language from the top admin bar.
--- Remove the page's translation.
--- Remove it from Trash also.
--- Repeat this for all secondary languages.
--- Switch back to the default language.
- Translate the page again.
- And see if the problem is resolved.

We've checked in a fresh site with latest WPML plugins and the issue doesn't happen. So I believe if you try the above mentioned, the problem should be resolved.

Please let me know and I'll try my best to help you further on the matter.

Regards.

August 9, 2024 at 1:51 am #16054680

federicoB-41

Hello.

I tried all of this already. I do not know why you didn't have access to the chat with a person before, but we already updated all plugins on staging and also disabled all plugins except WPML. The issue kept happening and I was told that it is related to the website database. So, please check the dialogue history please, and then check the staging website. You should have credentials to log in inside the private message.

August 9, 2024 at 6:28 am #16054917

Waqas Bin Hasan
Supporter

Languages: English (English )

Timezone: Asia/Karachi (GMT+05:00)

Thank you for the updates, I'm checking this and 'll get back to you accordingly.

August 9, 2024 at 7:36 am #16055266

Waqas Bin Hasan
Supporter

Languages: English (English )

Timezone: Asia/Karachi (GMT+05:00)

Thank you for your patience and cooperation.

I've tried several thing without any luck. So I need to escalate the issue to our 2nd tier team for a detailed investigation.

For this purpose, I need to take a backup of the site after remove the unnecessary stuff like inactive plugins and themes to keep the package size smaller.

Is this OK for you? Please let me know.

August 9, 2024 at 7:55 am #16055302

federicoB-41

Hello. Thanks for checking. Yes, it is okay to make changes to the website. I gave you access to the staging website, so feel free to do whatever needed with it.

August 9, 2024 at 10:40 am #16056023

Waqas Bin Hasan
Supporter

Languages: English (English )

Timezone: Asia/Karachi (GMT+05:00)

Thank you for confirmation, I've escalated the issue to our 2nd tier team.

Although I've created a package after removing unnecessary plugins and themes but it is still 4GB+, which I am also trying to download.

Please keep the staging site access open. I'll update you as soon as I hear back from the team.

August 14, 2024 at 2:37 am #16068555

federicoB-41

Hello Waqas. Thanks for your help. Any updates on this issue?

August 15, 2024 at 5:48 am #16072993

Waqas Bin Hasan
Supporter

Languages: English (English )

Timezone: Asia/Karachi (GMT+05:00)

Thank you for your patience and cooperation.

Our team investigated the issue and wants to understand that if there were any recent changes in server or site's environment? Because if it has been working previously, why it is not working now?

We can see it works with CTE but not when using the WordPress Editor but we cannot catch any significant errors.

They further noted:

We have added a php-info.php file to the staging. You can access it at:
hidden link

According to the info there are quiet many PHP functions disabled, that can cause such unexpected behavior:

exec, passthru, shell_exec, system, proc_open, popen, show_source, apache_child_terminate, apache_get_modules, apache_get_version, apache_getenv, apache_note, apache_setenv, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid, posix_getpwuid, posix_uname, pclose, dl, diskfreespace, disk_total_space, pcntl_exec, proc_close, proc_get_status, proc_nice, proc_terminate, symlink, link, pcntl_alarm, pcntl_fork, pcntl_waitpid, pcntl_wait, pcntl_wifexited, pcntl_wifstopped, pcntl_wifsignaled, pcntl_wexitstatus, pcntl_wtermsig, pcntl_wstopsig, pcntl_signal, pcntl_signal_dispatch, pcntl_get_last_error, pcntl_strerror, pcntl_sigprocmask, pcntl_sigwaitinfo, pcntl_sigtimedwait, pcntl_exec, pcntl_getpriority, pcntl_setpriority, highlight_file, lchgrp, lchown, prog_get_status, getmypid, getmyuid, getmygid, getrusage, getmyinode, get_current_user, libxml_disable_entity_loader

The client should revise php.ini for issues.

Many of them are used for system-level operations, and while WPML doesn't directly depend on all of them, their absence might impact underlying processes or interactions with other plugins.

So they suggest to check with your hosting or service provider and see if they can enable and/or provide any technical information. Here are WPML's minimum requirements https://wpml.org/home/minimum-requirements/, which may also be helpful for the above mentioned.

Please let me know.

August 16, 2024 at 6:35 am #16076901

federicoB-41

Hi Waqas. I contacted my hosting provider support (Kisnta) and I've been told that the following functions can't be enabled due to security reasons:
exec()
popen
proc_open
proc_close
proc_get_status
proc_terminate
proc_nice
posix_kill
symlink
getmypid
getpwuid / posix_getpwuid
pcntl_signal()
get_current_user
disk_total_space()

However, the problem turned out to be because of NGINX security headers that we added recently to improve the website security. Specifically these two:
add_header Referrer-Policy "strict-origin";
add_header Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self)";

If possible, can you test it on your environment to confirm that this is a problem? And why is it happening? Please let me know!

August 16, 2024 at 12:12 pm #16078220

Waqas Bin Hasan
Supporter

Languages: English (English )

Timezone: Asia/Karachi (GMT+05:00)

Thank you for the updates. I'm checking with our 2nd tier team and 'll update you accordingly.

However as per my understanding, the strict-origin Referrer-Policy HTTP header in browsers prevents leaks of private data by only sending the origin in the Referer header for cross-origin requests. This policy is designed to protect user privacy by not sending the full URL, which may include more data than is necessary. For example, the full URL may include the path and query string, which could be used to access private data.

While, the Permissions-Policy header in HTTP is a security header that lets you control which browser features can be used in a document or within any <iframe> elements in the document. It can help restrict unauthorized access or usage of browser features by web resources, and can ensure user privacy. For example, you can use the Permissions-Policy header to control whether the current page and any pages it embeds have access to the user's camera, microphone, and speaker. You can also prevent external <iframe>s from using browser features.

So I believe, these headers may be the problems but not so very sure. I'll get back to you accordingly.

August 20, 2024 at 10:35 am #16086584

Waqas Bin Hasan
Supporter

Languages: English (English )

Timezone: Asia/Karachi (GMT+05:00)

Thank you for your patience and cooperation. Our team checked for those headers in a fresh installation:

We tried recreating this on a sandbox (nginx/1.22.1) using the following plugin:
https://wordpress.org/plugins/http-headers/

After activation, go to Settings > HTTP Headers.
In the plugin settings, you can add custom headers. You’ll find a form where you can input header names and values.

Add Security Headers:

For the Referrer-Policy header, set:
Header Name: Referrer-Policy
Header Value: strict-origin

For the Permissions-Policy header, set:
Header Name: Permissions-Policy
Header Value: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self)

The issue does not occur on our sandbox:
hidden link (one-click login).

Please clarify with the client that this seems to be Kinsta-related. Please ask 'em if they can recreate the issue on a new WordPress install on their server.

The staging access is sadly not working anymore. So I'd request to check as mentioned above. You can also check in our sandbox site as mentioned above.

August 23, 2024 at 4:26 am #16097093

federicoB-41

Hello Waqas. Thank you for your detailed response and sorry for my late response.

I checked the staging website you shared and yes, the translation functionality of WPML indeed works as needed. However, the custom plugin for adding headers the WPML team tested does not seem to actually work. If you go to the website that checks security headers, for example, hidden link, and test your staging website in it (hidden link), you will see that security headers are actually not applied and not recognized. As far as I know, headers should be added on the server-side, to the NGINX config file, and adding them via the WP plugin won't work. Please correct me if I am wrong.

Also, sorry for the not working staging website. Please allow me to send you a private message as my next reply, and I will share with you the credentials of a re-created staging website.

Thank you very much for your support again!

Screenshot 2024-08-23 at 13.24.42.png
August 23, 2024 at 10:38 am #16098225

Waqas Bin Hasan
Supporter

Languages: English (English )

Timezone: Asia/Karachi (GMT+05:00)

Thank you for the updates.

I've set your next reply as private to share the staging site access safely.

IMPORTANT: If you don't see the section for providing access information, do not write in the message box or the information may appear as public.

See https://wpml.org/purchase/support-policy/privacy-and-security-when-providing-debug-information-for-support/ for details on privacy and security.