How to Fix the “403 Forbidden” Error on Your Website

A "403 Forbidden" error means the server understood the request but refuses to fulfil it — access is denied. Something is telling the server "do not show this", and the fix is finding what. The causes are well known and each is quick to check.

The usual causes

• Wrong file or folder permissions — the web server cannot read the file. Set folders to 755 and files to 644. See checking permissions.
• A missing index file — no index.html or index.php, with directory listing switched off.
• A blocking .htaccess rule — a deny directive or a bad rewrite. See editing .htaccess.
• An IP block — your address was blocked by a firewall or security tool.
• ModSecurity flagging the request as suspicious.

Step-by-step diagnosis

1. Check permissions on the affected file and its folder.
2. Confirm an index file exists in that directory.
3. Test your .htaccess by temporarily renaming it and reloading.
4. Check whether your IP is blocked — see the IP Blocker and unblock yourself if needed.
5. Review the error log — a ModSecurity block shows there. See the error log.

If ModSecurity is the cause

A security rule may be blocking a legitimate action. Our guide on ModSecurity in cPanel explains how it works and how to handle false positives.

Frequently asked questions

I get 403 on my whole site, not one page.

A site-wide 403 usually means a permissions problem on the root folder, a missing index file, or a blocking .htaccess at the top level. Start with permissions and .htaccess.

I locked myself out after too many login attempts.

Security tools block IPs after repeated failures. Wait for the block to lift, or whitelist your address — see managing IPs in CSF, or ask us to unblock it.

Only wp-admin gives a 403.

That often means a security rule or a protection plugin restricting admin access, or a permissions issue on wp-admin. Check both, and confirm your IP is not blocked.