A 403 Forbidden error means the server understood the request but refused access. In WordPress, the cause is often file permissions, a security rule, a damaged .htaccess file, a plugin conflict, CDN protection, or an incorrect ownership setting.
Start by determining whether the error affects the entire website, wp-admin, one page, or one file.
1. Check the Exact URL and Scope
Test the homepage, an internal page, /wp-admin/, and the affected file or directory. Also test a private browser window.
- If one page fails, check its security and redirect rules.
- If wp-admin fails, investigate login protection and administrator restrictions.
- If images or downloads fail, check file permissions and hotlink protection.
- If everything fails, focus on the server, CDN,
.htaccess, and file ownership.
2. Clear Caches and Check the CDN
Clear the WordPress cache, hosting cache, CDN cache, and browser cache. Temporarily pause CDN proxying only if you understand the security and DNS impact.
Check Cloudflare or another firewall for a blocked request, country rule, IP rule, bot rule, or managed security event.
3. Check WordPress Security Plugins
Security plugins may block an IP address, administrator path, REST API request, file type, or suspicious URL pattern.
Review the plugin’s firewall and activity logs. If wp-admin is unavailable, temporarily rename the suspected plugin folder inside wp-content/plugins and test again.
4. Reset the .htaccess File
On Apache servers, a damaged or overly restrictive .htaccess file can deny access.
- Download a backup of the current
.htaccessfile. - Rename it to
.htaccess-old. - Test the website.
- If the site works, open Settings, then Permalinks.
- Save the settings to generate fresh WordPress rules.
This does not replace rules managed by Nginx, a CDN, or the hosting platform.
5. Check File and Directory Permissions
Typical WordPress permissions are:
- Directories:
755 - Files:
644 wp-config.php: may use a stricter setting depending on the host
Do not set files or directories to 777. Overly open permissions create a security risk and may still be rejected by the server.
6. Check File Ownership
Correct numeric permissions will not help if the files belong to the wrong server user. Ownership problems commonly appear after manual migrations, command-line operations, or restoring files from another account.
Ask the hosting provider to verify ownership if you are uncertain.
7. Check Hotlink and Password Protection
Hotlink protection can block images or files requested from another domain. Directory privacy or password protection can also produce a 403 response when its configuration is incomplete.
Review these settings in cPanel or the hosting dashboard.
8. Check ModSecurity and Hosting Firewall Rules
ModSecurity or another web application firewall may reject a legitimate request because its URL, form content, or code resembles an attack.
Ask the host for the rule ID and log entry that triggered the block. Avoid disabling the entire firewall permanently when one rule can be reviewed or excluded safely.
9. Check for Malware and Unauthorized Changes
Malware, injected rules, and compromised plugins can modify access controls. Compare recent file changes, scan the website, and inspect unfamiliar rules before restoring access.
You can also check whether Google Safe Browsing has blocked the website.
10. Contact the Host With Specific Evidence
Provide the exact URL, timestamp, your IP address if requested, and the steps that trigger the error. Ask for the corresponding server or firewall log entry.
Can a 403 Error Affect SEO?
Yes. Search engines cannot crawl content that consistently returns 403. If Googlebot is blocked while visitors are allowed, the problem may be difficult to notice without log analysis or Google Search Console.
