It's definitely not something in vhosts or in the .htaccess
Apache Vhost Template:
# vhost_start DOMAIN_REPLACE
<VirtualHost IP_REPLACE:PORT_REPLACE>
ServerName DOMAIN_REPLACE
ServerAlias
www.DOMAIN_REPLACE ServerAdmin webmaster@DOMAIN_REPLACE
DocumentRoot PATH_REPLACE
UseCanonicalName Off
ScriptAlias /cgi-bin/ PATH_REPLACE/cgi-bin/
# Custom settings are loaded below this line (if any exist)
# Include "/usr/local/apache/conf/userdata/USER_REPLACE/DOMAIN_REPLACE/*.conf
<IfModule mod_userdir.c>
UserDir disabled
UserDir enabled USER_REPLACE
</IfModule>
<IfModule mod_suexec.c>
SuexecUserGroup USER_REPLACE USER_REPLACE
</IfModule>
<IfModule mod_suphp.c>
suPHP_UserGroup USER_REPLACE USER_REPLACE
suPHP_ConfigPath /home/USER_REPLACE
</IfModule>
<Directory "PATH_REPLACE">
AllowOverride All
</Directory>
# Apache Virtual host file starts here
server {
listen YOURSERVERIP:NGINXPORT;
access_log /var/log/nginx/access.YOURDOMAIN.log;
error_log /var/log/nginx/error.YOURDOMAIN.log;
server_name YOURDOMAIN
www.YOURDOMAIN;root DOCROOT;
location / {
location ~.*\.(3gp|gif|jpg|jpeg|png|ico|wmv|avi|asf|asx|mpg|mpeg|mp4|pls|mp3|mid|wav|swf|flv|html|htm|txt|js|css|exe|zip|tar|rar|gz|tgz|bz2|uha|7z|doc|docx|xls|xlsx|pdf|iso|woff|ttf|svg|eot|sh)\$ {
expires 7d; #Comment this out if you are using the apache backend cache-control/expires headers.
try_files \$uri \@backend;
}
error_page 405 = \@backend;
error_page 500 = \@custom;
add_header X-Cache "HIT from Backend";
proxy_pass
http://YOURSERVERIP:PROXYPORT;include proxy.inc;
}
location \@backend {
internal;
proxy_pass
http://YOURSERVERIP:PROXYPORT;include proxy.inc;
}
location \@custom {
internal;
proxy_pass
http://YOURSERVERIP:PROXYPORT;include proxy.inc;
}
location ~ .*\.(php|jsp|cgi|pl|py)?\$ {
proxy_pass
http://YOURSERVERIP:PROXYPORT;include proxy.inc;
}
location ~ /\.ht {
deny all;
}
}
# Virtual host file ends here
# Nginx Virtual host file starts here:
Every single domain on the server blocks Apache/Nginx access to a folder named "uploads"