Here's mine

I first realized there was a problem when I started getting 403 Forbidden errors when attempting to authenticate. I'd been using phpMyId for some time to provide an OpenID endpoint for myself here on monksp.org, which I now find to be deprecated. WordPress provides an OpenID module, so I've enabled that and started using it instead. I originally thought that I somehow screwed up the permissions on my OpenID directory. The WordPress module, however, doesn't redirect to an actual page, but to a rewritten URL pointing to index.php. There shouldn't be a 403 on just the OpenID. It should affect every single page that gets served from my WordPress install, simply because index.php is the only page that ever gets served.

While researching the problem, I found out that there was more to the problem than just my 403 problem. The WordPress OpenID module version 3.3.3 seems to not work right, however, at least with WordPress 3.x. I had to grab the 3.3.2 version and alter its version number so that it won't get updated.

After all that, I was still getting forbidden errors when attempting to log into a different site using my OpenID credentials. Turns out that the culprit was Apache's mod_security. Since I use a shared web hosting service, I didn't realize that the security rules changed when my host was acquired by a different one. mod_security prevents URLs from including other URLs in the query string, so whenever I tried to log in everywhere, the webserver itself would reject the page.

It took me a while to find the mod_security stuff. Hope this saves someone else some search time.