Guide
How to fix a 403 Forbidden error on your website
A 403 Forbidden error means the server received your request but is refusing to show the page. The usual causes are wrong file permissions, a faulty .htaccess file, a missing index file, a security rule blocking your address, or a plugin conflict. Work through them in order, starting with the error log, and most 403 errors are fixed in minutes.
What is happening
How a 403 error is produced
- Browser asksYour visitor requests a page or file
- Server checks rulesPermissions, .htaccess and firewall rules are read
- A rule says noAccess is denied for that request
- 403 returnedThe visitor sees Forbidden
The server is working. It has simply been told, by some rule, not to serve this particular thing.
The basics
What a 403 Forbidden error actually means
Every web request returns a status code. A 200 means all is well, a 404 means the page was not found, and a 403 means the server found the resource but will not hand it over. That is an important difference from a 404. With a 403, something exists at that address, and a rule is stopping access to it.
The error can appear on the whole site, on one folder, or on a single file such as an image or a script. Where it appears is your first clue. If the entire site shows 403, think about the home folder, the index file and the main .htaccess file. If only one page fails, think about that file or folder, or a security rule that matches something in the request.
Wording varies between browsers and servers. You may see Forbidden, Access Denied, HTTP Error 403, or You do not have permission to access this resource. They all describe the same status. A related message, 401, means you must log in first, which is a different problem.
Useful numbers
The numbers worth remembering
Stuck on a 403?
Our live chat is open 24/7. Send the page address and the time it happened and we can check the logs with you.
Step by step
Fixing a 403 error in a sensible order
Check it is not just you
Open the page in a private window and on a phone using mobile data. If it works there, the problem is your browser, your network or your IP address being blocked.
Clear cache and cookies
A stale cached response can keep showing the old error after the cause is fixed. Clear the site data for your domain and reload.
Look at the error log
In your control panel, open the error log for the domain. A 403 entry usually names the file and the reason, such as a permissions failure or a rule that matched.
Check file and folder permissions
Folders should normally be 755 and files 644. Anything set to 000, 600 on a folder, or 777 may be refused or blocked for safety.
Rename .htaccess to test
Rename the file to .htaccess-old and reload. If the site now loads, a rule inside was responsible. Recreate a clean file and add rules back one at a time.
Confirm an index file exists
Each folder that should show a page needs an index.html, index.php or similar. Without one, and with directory listing turned off, the server answers 403.
Disable plugins or security rules
On WordPress, rename the plugins folder temporarily. A security plugin or a firewall rule may be blocking you or a legitimate request.
Causes
Common causes of a 403 and how to recognise them
| Cause | How it looks | The fix |
|---|---|---|
| Wrong permissions | Error log mentions permission denied | Set folders to 755 and files to 644 |
| Faulty .htaccess | Whole site shows 403 after an edit | Restore the last working file or recreate it |
| No index file | A folder shows 403 but files inside load | Upload an index file to that folder |
| Security rule | Only some requests or forms fail | Check the firewall log, adjust or allow the rule |
| Your IP is blocked | Works on mobile data, fails at home | Remove the block in the IP deny list or ask us |
| Hotlink protection | Images fail when shown on other sites | Allow the sites that should link to you |
| Wrong ownership | Appears after files were restored or moved | Reset ownership with a support request |
| Plugin conflict | Began after an update on WordPress | Deactivate plugins one by one to find it |
Permissions
Getting file permissions right
Permissions are three numbers that describe who may read, write and execute a file: the owner, the group and everyone else. A value of 644 lets the owner read and write while others can only read. A value of 755 adds the ability to enter a folder, which is why folders need it. These are the safe defaults for almost every website.
Problems appear when permissions are too tight or too loose. If a folder is set to 600, even the web server cannot enter it, and you get a 403. If something is set to 777, a hardened server may refuse to run it, because anyone could change it. On shared hosting, isolation tools like CloudLinux and security tools make the safe values even more important.
You can change permissions in the file manager in your control panel, or through FTP software by right-clicking a file. Change one folder first and test. Avoid applying a blanket permission change to every file in one go, because executable scripts, configuration files and uploads have slightly different needs.
Never fix a permission problem by setting everything to 777. It may seem to work, but it weakens security and can trigger new 403 or 500 errors on a protected server.
Who is affected
Whole site or just one page
The whole site shows 403
- Check the main .htaccess file first
- Check that the home folder has an index file
- Check the top folder permissions
- Check the domain points at the right folder
- Look for a recent change or restore
Only one page or file shows 403
- Check that file permissions are 644
- Check the folder containing it is 755
- Look for a firewall rule matching its name
- Check for a deny rule in a local .htaccess
- Try the same file after renaming it
Security rules
When the firewall is doing its job
Our servers run a ModSecurity firewall and Imunify360 protection. They exist to stop real attacks, and now and then they block a request that looks suspicious but is harmless. Typical examples are a form field containing code-like text, a long query string, or a script uploading a file type that attackers often abuse.
If a 403 only appears when you submit a specific form or save a specific page, suspect a security rule. Note the exact time and what you were doing, then send it to us through live chat or a ticket. We can look at the firewall log and tell you which rule matched, and whether it is safe to make an exception.
Your own IP address can also end up blocked after repeated failed logins, which is a protection against password guessing. If the site works on mobile data but not at home, that is the pattern. Tell us your public IP address, which you can find by searching for what is my IP, and we can check the block lists.
Quick list
A 403 checklist to run through
- Test in a private window and on mobile data
- Clear the cache and cookies for the site
- Read the latest lines of the error log
- Check folders are 755 and files are 644
- Rename .htaccess and retest
- Confirm an index file is present
- Disable plugins by renaming their folder
- Check hotlink protection and IP deny lists
- Look at whether a recent update coincided
- Ask live chat to check the firewall log
WordPress
Special cases on WordPress sites
WordPress adds its own sources of 403. A security plugin may block the admin login after failed attempts, a caching plugin may write a bad rule into .htaccess, and a permalinks change can break rewrite rules. Rename the plugins folder inside wp-content to switch every plugin off at once, then rename it back and reactivate them one at a time until the error returns.
If wp-admin alone is forbidden, look for an extra .htaccess file inside the wp-admin folder, or for a rule that limits access by IP address. If the problem started after you saved Permalinks, resaving them can regenerate the standard rewrite block. Keep a copy of your working .htaccess so you can compare.
After you find the cause, write it down. A short note about what broke and what fixed it saves a lot of time the next time, and it helps whoever looks after the site after you.
Prevention
Stopping 403 errors coming back
Back up before edits
Copy .htaccess before changing it. A one-second copy removes most of the risk.
Keep safe permissions
Use 755 for folders and 644 for files and avoid blanket changes.
Change one thing at once
If you add a rule or plugin, test straight away so the cause is obvious.
Use staging for big changes
Try risky changes on a copy of the site before the live one.
Note the time of changes
A time makes the log entry easy to find later.
Ask early
A short chat with us can save an hour of guessing.
Looking after the site
Why it pays to keep backups ready
When a 403 appears right after an edit or an update, a recent backup lets you compare the working version with the broken one. Every plan includes weekly remote backups kept for about a month, and you can read more in our website backup guide.
A good habit is to take your own copy before any edit to .htaccess, wp-config.php or a theme file. Then if something breaks, you can put the old file back and think calmly rather than in a rush.
FAQ
Common questions
What is the difference between 403 and 404?
A 404 means the page was not found. A 403 means it exists but the server refuses to serve it because of a rule or permission.
Can a 403 error harm my search rankings?
A short outage usually does not, but if search engines keep getting 403 for important pages, those pages can drop out of results. Fix it promptly.
Why does my site work on mobile data but not at home?
Your home IP address is probably blocked by a security rule or deny list. Contact live chat with your public IP and we can check.
Which permissions should I use?
Folders are normally 755 and files 644. Avoid 777 because it is unsafe and can itself cause errors.
Should I delete my .htaccess file?
Rename it rather than delete it, so you can restore it. Then recreate a clean one, and on WordPress resave Permalinks to rebuild the default rules.
Keep reading
Related pages
Hosting with security and support built in
Firewall, malware scanning and live chat open 24/7 on every plan.