The path AutoSSL uses to prove domain control.
WHAT HAPPENS
AutoSSL places a file under /.well-known/acme-challenge/ in your site's document root. The certificate authority requests that file over HTTP. If it retrieves the expected content, validation succeeds.
WHAT BREAKS IT
A redirect rule that catches every request, including this path A security plugin blocking access to dotted directories A maintenance mode plugin returning a holding page for everything An application router intercepting all requests File permissions preventing the file being written or read
THE FIX
Exclude the path from redirects. In .htaccess, place this above your redirect rules:
RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/Disable maintenance mode while issuing a certificate.
In a framework where the router handles everything, ensure static files under that path are served directly.
A DIAGNOSTIC
Create a plain text file at /.well-known/acme-challenge/test.txt and visit it in a browser. If you cannot retrieve it, AutoSSL cannot either.
