403 Forbidden Error: Meaning & Fix
A 403 Forbidden error means the server found the page and deliberately refused to serve it. Check five causes in order: file permissions (folders 755, files 644), a missing index file, a bad .htaccess rule, your IP blocked in cPanel, the firewall or Cloudflare, and a mod_security false positive. Logging in again never fixes a 403.
For site owners and developers on cPanel or WordPress hosting who see 403 Forbidden on a page, a folder or wp-admin.
knowledge
- Read time
- 6 min
- Sections
- 7
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
What does a 403 Forbidden error mean?
A 403 Forbidden error means the server found the requested page and deliberately refused to serve it. Logging in again never fixes it, because the refusal comes from permissions, server rules, an IP block or a firewall, not from who you are.
Work through the causes in this order; each check takes about a minute and rules out one layer:
| Order | Cause | Typical clue |
|---|---|---|
| 1 | File or folder permissions | Whole site or one folder fails after a migration or upload |
| 2 | Missing index file | The domain root or a folder 403s, inner pages may work |
| 3 | .htaccess rules | Site broke right after a plugin, redirect or security change |
| 4 | IP block in cPanel, the server firewall or Cloudflare | Works on mobile data, fails on office Wi-Fi |
| 5 | mod_security or WAF false positive | Browsing works, but saving a page or submitting a form fails |
The Apache error log usually names the layer: AH01630: client denied by server configuration points at a rule, and AH01276: Cannot serve directory at a missing index file. cPanel shows these under Metrics › Errors.
How do you fix 403 errors caused by file permissions?
Set directories to 755 and files to 644; WordPress's wp-config.php can be tighter at 640 or 600. The web server reads files as its own user, so a folder at 644 (missing the execute bit it needs to be entered) or a file at 600 owned by the wrong user returns 403.
In cPanel File Manager, select the folder, choose Permissions and set the value. Over SSH, from the site's document root:
find . -type d -exec chmod 755 {} +
find . -type f -exec chmod 644 {} +
chmod 640 wp-config.phpNever use 777. It lets any process on the server change your files, and many servers refuse to run world-writable scripts at all. Images that 403 while pages load usually mean wp-content/uploads came across from a migration with the wrong modes.
Can a missing index file cause a 403?
Yes: when a folder has no index.php or index.html and directory listing is disabled, the server answers the folder URL with 403. This is common on a fresh account where files were uploaded into a subfolder, or when the index file was renamed.
Check that the document root (often public_html) contains index.php for WordPress or index.html for a static site. Directory listing is turned off with Options -Indexes, which is the right security setting; the fix is to add the index file, not to turn listing on. The upload steps are in uploading a website by FTP.
How do you check whether .htaccess is causing the 403?
Rename .htaccess to .htaccess.bak and reload the site; if the 403 disappears, a rule in that file is the cause. Apache and LiteSpeed read it on every request, so one bad line can block an entire site.
Restore the file and look for Require all denied, Deny from lines, IP allow-lists or <Files> blocks added by a security plugin, hotlink protection or a broken redirect. On WordPress, Settings › Permalinks › Save Changes regenerates the default rewrite block; add custom rules back one at a time until the 403 returns. The .htaccess guide explains each directive.
How do you clear an IP block that causes a 403?
Check the three layers in turn: cPanel's IP Blocker, the server firewall, and Cloudflare if the domain is proxied through it. A test from mobile data, which uses a different IP, tells you quickly whether a block is involved.
- cPanel: Security › IP Blocker lists addresses the site owner blocked; remove yours if it is there.
- Server firewall (for example CSF): blocks after repeated failed logins apply to every site on the server for your IP; only the host can clear them on shared hosting. Send your public IP and the time of the error. On a VPS you manage, see installing the CSF firewall for its allow and deny commands.
- Cloudflare: Security › Events shows whether a WAF rule, country block or IP access rule stopped the request before it reached your server.
Internet providers reassign addresses, so a block aimed at a previous holder of your IP can hit you. On WebJi® cPanel hosting, email support@webji.services with your IP for a firewall check; replies come 24/7 in Hindi and English.
How do you fix a 403 from mod_security or a WAF?
Find the rule ID that fired, then have that single rule whitelisted for your domain or URL, keeping the rest of the firewall active. The tell-tale sign is that general browsing works but one action, such as saving a post, updating a plugin or submitting a form, returns 403.
cPanel's Metrics › Errors shows ModSecurity entries with a rule [id "…"]. Do not ask for mod_security to be switched off for the whole site; the rule disabled for convenience may be the one stopping an exploit next week. WordPress security plugins such as Wordfence write their own blocks too: pause the plugin briefly, and if the 403 goes away, adjust its settings rather than leaving it off.
How is a 403 different from a 401 or a 404?
A 401 means the server needs you to authenticate, a 403 means it knows the request and refuses it anyway, and a 404 means nothing exists at that address. Reading the code first saves a wasted fix cycle.
| Code | Meaning | Fix |
|---|---|---|
| 401 Unauthorized | Credentials are missing or rejected | Log in with valid credentials |
| 403 Forbidden | Understood and refused | Permissions, index file, .htaccess, IP block or WAF (this guide) |
| 404 Not Found | No resource at that URL | Correct the link or restore the page |
Check the status from the command line with curl -I https://example.in/page/. A 500 instead points to a different set of fixes, covered in fixing a 500 error on cPanel hosting; a hacked site that throws 403s is covered in recovering a hacked WordPress site.
Frequently asked questions
Why do I get a 403 only on my own website?
If other people can open the site, your IP is probably blocked, often after several failed logins triggered the server firewall. Try mobile data to confirm, then ask the host to unblock your public IP. If everyone sees the 403, start with permissions and .htaccess instead.
Why does wp-admin show 403 while the website works?
Usually a security plugin, an IP allow-list on wp-admin in .htaccess, or a WAF rule firing on admin requests. Rename the security plugin's folder in wp-content/plugins to disable it, test again, and check .htaccess inside wp-admin if one exists.
Can clearing the browser cache fix a 403?
Rarely. A 403 comes from the server, a firewall or a CDN. Clearing cache helps only if an old cached error page is being shown; a private window test tells you immediately whether the server is still refusing.
Does a 403 error hurt SEO?
Yes, if it lasts. Googlebot cannot crawl pages that return 403, and persistent errors can drop them from the index. Check Search Console's Pages report after a fix, and make sure firewall rules are not blocking Googlebot itself.
Last editorial update: 15 November 2026.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.