I was wondering if it was your .htaccess file. Can you post its contents?
Here's the one in my main root. The names have changed to protect the innocent
# FORCE NON-WWW
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.mydomain\.net [NC]
RewriteRule ^(.*)$
http://mydomain.net/$1 [L,R=301]
</IfModule>
# END FORCE NON-WWW
# START SSL
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{SERVER_PORT} 90
RewriteRule ^(.*)$
https://mydomain.net/$1 [R,L]
</IfModule>
# END SSL
# START MOD SECURITY
<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>
# END MOD SECURITY
# START XENFORO
ErrorDocument 401 default
ErrorDocument 403 default
ErrorDocument 404 default
ErrorDocument 405 default
ErrorDocument 406 default
ErrorDocument 500 default
ErrorDocument 501 default
ErrorDocument 503 default
<IfModule mod_rewrite.c>
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^.*$ - [NC,L]
RewriteRule ^(data/|js/|styles/|install/|favicon\.ico|crossdomain\.xml|robots\.txt) - [NC,L]
RewriteRule ^.*$ index.php [NC,L]
</IfModule>
# END XENFORO
# START ACP PROTECTION
<FilesMatch "admin.php">
AuthType Basic
AuthName "ACP"
AuthUserFile /home/me/.htpassword
require valid-user
</FilesMatch>
# END ACP PROTECTION
# START CONFIG PROTECTION
<FilesMatch "config.php">
deny from all
</FilesMatch>
# END CONFIG PROTECTION
# HOTLINK PROTECTION
<IfModule mod_rewrite.c>
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^
http://mydomain/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^
http://mydomain.net$ [NC]
RewriteCond %{HTTP_REFERER} !^
http://www.mydomain.net/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^
http://www.mydomain.net$ [NC]
RewriteRule .*\.(jpg|jpeg|gif|png|bmp|tiff|pdf|mp3)$ - [F,NC]
</IfModule>
# END HOTLINK PROTECTION
.
