Actually incorrect in textbook sense, but widely accepted in recent years to avoid specifying gender.

Also in less recent years. They has always been used in the singular in cases where gender is not apparent (e.g. with babies)

And also where it is:

    There's not a man I meet but doth salute me
    As if I were their well-acquainted friend

- A Comedy of Errors, Act IV, Scene 3

Widely accepted back at least as far as Shakespeare. The objection that it's incorrect is what's recent.

For example "they must have forgotten to add the catch all redirect in the .htaccess file"

English grammar textbooks started excluding it because doing so made the language more like Latin and this was considered a good thing.