English
Magyar
Are you sure the 403 Forbidden error is caused by incorrect file permissions? Not necessarily. An .htaccess setting or a security rule may also be denying access. Fixing a 403 Forbidden error therefore begins with a systematic check of the source of the error, not with guesswork. Hasty changes to permissions can create a security risk or affect other website functions.
Firstly, it is worth finding out why the site is unavailable and how you can restore it safely. In this guide, we’ll go through the most common causes and show you how to narrow down the possible sources of the problem. The aim is to enable you to try out the basic fixes carefully, without taking any unnecessary risks.
We’ll show you where to check file permissions, the .htaccess file and the logs available on your hosting account, for example via the cPanel interface. We’ll also cover how to recognise a block caused by a hosting-side security rule, and what information you should gather when seeking assistance.
What does the 403 Forbidden error mean, and why does it appear?
A 403 Forbidden response indicates that the web server has received and interpreted the browser’s request, but has denied access to the requested content. The server is operational, but it does not permit the page or other resource to be displayed in response to that particular request. This overview of the 403 Forbidden error also distinguishes this response from the 401 code, which relates to authentication.
A 403 error code does not in itself prove that the website has been hacked, nor does it mean that the server has gone down. It can also be triggered by access settings, server configuration or security rules. The scope of the restriction varies: it may affect a single page, a directory or even the entire website. Therefore, before fixing the 403 Forbidden error, make a note of exactly which URLs and users are affected by the problem.
If only one subdirectory or file is inaccessible whilst the homepage loads, the issue is unlikely to affect the entire website. If several pages that were previously working return the same response, there may be a more widespread problem. These symptoms help you choose the next step to take, but on their own they do not identify the underlying cause.
What symptoms indicate a 403 access error?
You may see a ‘403 Forbidden’, ‘Forbidden’ or ‘Access denied’ message in your browser. Open the URL where the error occurred, then try accessing another public page on the same website. If that page loads, the restriction may be limited to a specific resource. If this is happening to several visitors, it is more likely that the website’s settings are affected. If you are the only one experiencing this, your current session or different access conditions may also be a factor.
The same error may appear with a variety of messages, depending on the web server and the website’s error page. The most common variations are:
- 403 Forbidden, Forbidden, HTTP 403 Forbidden
- Error 403, 403 Error, 403 Forbidden Error
- 403 Forbidden: Access Denied, “You do not have permission to access this resource”
- 403 Forbidden nginx, Nginx 403 Forbidden
Many websites display their own customised error pages, so the message may differ; however, the ‘Network’ tab in the browser’s developer tools will always show the 403 status code.
What is the difference between 403, 401 and 404?
The three codes indicate different situations:
- 403: The server has received the request but is denying access. For example, it will not display the contents of a directory because access to it is prohibited.
- 401: Access is restricted to authorised users. The server may request authentication before allowing you to view the content.
- 404: The requested resource cannot be found or is not available at the specified address.
Understanding the difference helps with initial troubleshooting: a 401 error may indicate an authentication issue, a 404 error may indicate a URL or resource problem, whilst a 403 error indicates access denied. The exact cause can be identified by further examination of the settings and logs.
How can you find out what is causing the 403 Forbidden error?
For quick and secure troubleshooting, first establish the scope and origin of the issue. Do not immediately change file permissions or the configuration: gather data first and make a backup before making any changes. This makes it easier to determine whether the restriction stems from the browser, the network, a file or a hosting provider’s rule. The technical explanation of the 403 Forbidden error also provides a detailed overview of the technical background to the 403 response.
Initial checks in the browser and on the hosting server
Please follow the steps below and note whether the error changes:
- First step: check the address. Make sure the URL is correct, then try opening the page in question as well as another public page.
- Step two: try using a different browser. You could also test it in incognito mode or on a different device. This may reveal whether the issue is limited to that particular browser or browsing session.
- Step three: switch networks. Compare the result with that from a different internet connection. If the block only occurs from one network or IP address, make a note of this, as it may be due to an access or security policy.
- Step four: examine the hosting files and logs. In cPanel, you can use the File Manager to review the contents and configuration files of the affected directory. Log entries from around the time of the error can help you determine which request or rule caused the block.
Recording the error and the time it occurred
Make a note of the affected URLs, the exact message displayed in the browser, the time the error first occurred, and whether other visitors are also experiencing the issue. Compare this time with any changes made to the website: for example, whether you installed or updated a plugin, or modified a theme or configuration file. A temporal match may provide a clue, but does not in itself prove the cause.
Before making any changes, make a backup of the relevant files and settings. If you use cPanel, the cPanel hosting management page will help you get to grips with the interface. With this information to hand, you can tackle the 403 Forbidden error more effectively, without having to guess or make unnecessary changes.
Fixing a 403 error: checking file permissions and .htaccess
Incorrect file permissions, an incorrect owner or access-restricting rules can all result in a 403 response. The server must not only be able to access the file, but also the directories leading to it. Before making any changes to the settings, make a copy of the relevant files and configurations. Then make only one change at a time and check whether the error has been resolved. The technical description of the HTTP 403 Forbidden status code also links this response to access being denied.
Checking file permissions and ownership
In your hosting account’s file manager, locate the directory and file associated with the page in question. Check that they belong to the correct user account on the hosting server and that the web server has the necessary access rights. Different permissions may be required for different directories and files, so do not apply the same settings to every item. The correct configuration depends on the hosting environment and the application’s requirements.
As a starting point: on Linux-based shared hosting plans (including aWh’s cPanel hosting plans), directories typically have 755 permissions and files 644; certain sensitive configuration files (such as WordPress’s wp-config.php file) may have stricter permissions (640 or 600). If the permissions for a file or directory are more restrictive than this (for example, a directory set to 600 or an image file set to 400), the web server will be unable to read it and will return a 403 response. The article on chmod and chown file permissions explains the meaning of these permissions in detail.
Do not set permissions to 777 across the board. This can grant broad access, pose a security risk and may not necessarily resolve the actual cause of the error. If you are unsure which value is appropriate, do not change it at random. You can also find information on managing website files and hosting on the cPanel hosting service page.
Is the index file missing?
If a directory does not contain an index.php or index.html file, and directory listing is disabled (which is the correct default setting for security reasons), the web server will return a 403 response to the directory’s URL. This often occurs after a new upload if the files have been placed in a subfolder or the name of the index file differs (for example, Index.html with a capital ‘I’). In such cases, check that the website’s files are in the correct root directory and that the index file is present there. Do not enable directory listing as a workaround, as this will make all the files in that directory visible.
Hotlinking protection
If only images, videos or downloadable files return a 403 response, and only when linked to from another website, hotlink protection is likely to be in operation. This prevents external sites from displaying media files directly from your hosting account, using your bandwidth. The server makes its decision based on the Referer header in the request: if this is not one of the authorised domains, it returns a 403 error instead of the file.
In cPanel, under the ‘Hotlink Protection’ menu item, you can see whether it is enabled and which domains are permitted to link to your files. If your own website running on a different domain or a CDN cannot access the files, add the relevant address to the list of permitted domains there. If you are linking to an image on a third-party website and receive a 403 error, you do not need to fix this on your own hosting account: upload the file to your own hosting account (if you have the rights to do so).
Testing .htaccess rules securely
A page may also be blocked by an access rule, a redirect or a setting created by an application in the .htaccess file. Before opening or renaming it, make a copy and save the original name and content. Do not delete any lines whose purpose or origin you do not know.
If a rule appears suspicious based on the logs or recent changes, change only that one setting, then check the affected page and the rest of the website’s functionality. Temporarily renaming the file may interrupt redirects or the routing required for the application to function. After testing, restore the original file if it is not confirmed to be the cause of the error. Do not disable security rules across the board. This ensures that the fix for the 403 Forbidden error remains targeted and is less likely to cause further access or security issues.
403 Forbidden error in WordPress: plugins and security rules
In WordPress, the plugin’s access rules, security settings or IP-based restrictions can also trigger a 403 response. The root cause may lie within the application, but the restriction may also be enforced by the web server or hosting configuration. You should therefore distinguish between settings that can be modified in WordPress and server-side rules. If you disable several security features at once whilst trying to fix the 403 Forbidden error, it will be more difficult to identify the source of the error, and your website’s security may also be compromised.
Checking for a ban caused by a WordPress plugin
Consider whether the error began after installing, updating or changing the settings of a plugin. Before you start testing, make a backup of your website. Next, temporarily deactivate a suspicious plugin in the WordPress dashboard, then check the same page. Test only one plugin at a time, so that the result is clearer.
If you cannot access the control panel, locate the directory of the affected extension in cPanel’s File Manager and temporarily rename it. After testing, restore the original name if the extension was not the cause of the block. If the error is resolved, review the extension’s access rules and settings, and then make only the necessary changes.
Security rules and web server logs
A firewall or other server-side security rule may block certain requests, IP addresses or routes. In such cases, disabling WordPress plugins may not necessarily resolve the issue, as the block is enforced at the hosting or web server level. If logs are available on the hosting account, look for entries corresponding to the time of the error. The timestamp, the affected URL and any rules that may have been flagged can help pinpoint the cause.
A common cause of issues on shared hosting is the web application firewall (such as ModSecurity), which blocks requests that resemble an attack (such as taking a backup of a post containing a code snippet), or IP-based blocking: You can also block addresses via the cPanel IP Blocker menu, and the server can automatically block IP addresses from which there have been numerous failed login attempts. If the error only occurs from a single network, check whether your own IP address is on the block list. For information on managing IP blocks, see the article on firewall IP blocking.
Do not permanently disable the firewall, and do not remove restrictions on IP addresses or requests across the board. Identify which specific rule caused the false block, and then modify only that rule. If the log indicates a server-side block, or if you are unable to safely modify the rule, review the guides in the hosting knowledge base and contact aWh’s support team with the details from the log entry to request assistance.
Checking whether a 403 error has been resolved, and when should you seek help from your hosting provider?
After making the change, don’t just check whether the error message has disappeared. Check whether access has been restored and whether the other important parts of the website are functioning correctly. If the block remains in place, or if a new operational error occurs after the fix, restore the backup taken before the change. After that, do not make any further changes at random.
Post-repair checks and restoration
Reopen the URL that was originally blocked, then test another public page as well. Try logging into the WordPress admin panel and check any features that may have been affected by the change. If the error has been resolved but the admin panel or a security feature is not working, revert to the original setting. For guidance on using the cPanel interface, the cPanel hosting information provides further assistance.
When are hosting configuration issues likely to occur?
It may indicate a hosting-side issue if the block affects several unrelated websites, is visible to other visitors, or is not resolved by testing WordPress plugins. Server-side blocking recorded in the logs, or blocking linked to an IP address or security rule, may also point in this direction. If you cannot access the necessary configuration, or it is unclear which server setting is causing the error, please contact aWh’s support team.
Please provide a brief, factual summary in your ticket. Please describe:
- the exact address of the page in question and the time the error first occurred;
- the steps required to reproduce the error, such as the path along which it occurs;
- whether the issue is also experienced by other browsers, networks or users;
- any changes made to plugins, themes or configurations prior to the error;
- the available log entries, as well as the changes and rollbacks that have already been tested.
When sending a log extract, please include only the data relating to the error, and do not share any passwords or other confidential access details. You can find further troubleshooting guides in the hosting knowledge base. Fixing a 403 Forbidden error is quicker and safer if you first identify the specific rule causing the block, rather than adjusting the settings.
Restore access using secure steps
The safest way to fix a 403 Forbidden error is to first identify the source of the restriction and only then modify file permissions, .htaccess rules or WordPress settings. Make a backup, test one change at a time, then check the affected page, the login page and any related functions. If the error persists on multiple pages, or if the log indicates a block on the hosting server, please contact aWh’s support team with the details you have recorded.
This requires a suitable hosting environment and secure management. Daily backups are performed on aWh’s cPanel hosting plans, allowing you to restore your site to its pre-change state; the control panel can be protected with two-factor authentication, and if you get stuck, our support team is here to help. Our knowledge base article provides an overview of the meanings of HTTP status codes.
If you’re looking for the right hosting solution for your website, take a look at aWh’s hosting solutions.
Frequently asked questions about the 403 Forbidden error
What does the 403 Forbidden error mean?
A 403 Forbidden error means that the server has received the request but is not granting access to the requested page or file. This differs from a 401 response, which requests authentication, and from a 404, where the resource cannot be found or is unavailable. The 403 code does not in itself indicate a hack or a server outage. The restriction may affect a single page or even the entire website.
How can a 403 error on a website be fixed?
Before fixing a 403 Forbidden error, check the affected URL and then try opening it in a different browser or from a different network. Check whether the error occurs on multiple pages and whether any configuration or application changes have been made recently. Make a backup before changing file permissions or .htaccess settings. Test only one change at a time, and do not generally relax permissions or disable security rules.
What can cause a 403 Forbidden error in WordPress?
In WordPress, a 403 error can be caused by a plugin access rule, a security setting or an IP address-based restriction. However, the block does not necessarily originate from WordPress itself: the web server or hosting configuration may also be blocking the request. If the error began after installing or modifying a plugin, take a backup, then test the suspect plugins one by one by temporarily deactivating them.
Does a 403 error mean that the website has been hacked?
No, the 403 response on its own does not necessarily mean that the website has been hacked. Access may also be denied due to incorrect file permissions, configuration rules, plugins or security systems. Regardless, check when the error started, which pages are affected, and whether there are any related entries in the hosting logs. Also check for any unknown changes or other unusual activity, but do not alter the security settings at random.
Could renaming the .htaccess file help to fix the 403 error?
Yes, renaming the file can help determine whether a rule in the .htaccess file is causing the block, but only use this as a temporary test. Before doing so, make a copy, note down the original filename, and then check the page in question. Renaming the file may also affect redirects or the application’s route handling. If the error persists, restore the original file and do not delete any unknown rules.
What should I do if the 403 error persists even after checking the file permissions?
If the file permissions appear to be correct, check the .htaccess file, the WordPress plugins, and the log entries for the firewall or other server-side rules. If the error affects multiple pages or visitors, or if the log indicates a hosting-side block, please contact aWh’s support team. Please provide the affected URL, the time of the error, the steps to reproduce it and any tests you have carried out so far. Please do not send any passwords or other confidential access details.