Error code 403 message access denied

From Wikipedia, the free encyclopedia

HTTP 403 is an HTTP status code meaning access to the requested resource is forbidden. The server understood the request, but will not fulfill it.

Specifications[edit]

HTTP 403 provides a distinct error case from HTTP 401; while HTTP 401 is returned when the client has not authenticated, and implies that a successful response may be returned following valid authentication, HTTP 403 is returned when the client is not permitted access to the resource despite providing authentication such as insufficient permissions of the authenticated account.^[a]

Error 403: «The server understood the request, but is refusing to authorize it.» (RFC 7231)^[1]

Error 401: «The request requires user authentication. The response MUST include a WWW-Authenticate header field (section 14.47) containing a challenge applicable to the requested resource. The client MAY repeat the request with a suitable Authorization header field (section 14.8). If the request already included Authorization credentials, then the 401 response indicates that authorization has been refused for those credentials.» (RFC 2616)^[2]

The Apache web server returns 403 Forbidden in response to requests for URL^[3] paths that corresponded to file system directories when directory listings have been disabled in the server and there is no Directory Index directive to specify an existing file to be returned to the browser. Some administrators configure the Mod proxy extension to Apache to block such requests and this will also return 403 Forbidden. Microsoft IIS responds in the same way when directory list
ings are denied in that server. In WebDAV, the 403 Forbidden response will be returned by the server if the client issued a PROPFIND request but did not also issue the required Depth header or issued a Depth header of infinity.^[3]

Substatus error codes for IIS[edit]

The following nonstandard codes are returned by Microsoft’s Internet Information Services, and are not officially recognized by IANA.

• 403.1 – Execute access forbidden
• 403.2 – Read access forbidden
• 403.3 – Write access forbidden
• 403.4 – SSL required
• 403.5 – SSL 128 required
• 403.6 – IP address rejected
• 403.7 – Client certificate required
• 403.8 – Site access denied
• 403.9 – Too many users
• 403.10 – Invalid configuration
• 403.11 – Password change
• 403.12 – Mapper denied access
• 403.13 – Client certificate revoked
• 403.14 – Directory listing denied
• 403.15 – Client Access Licenses exceeded
• 403.16 – Client certificate is untrusted or invalid
• 403.17 – Client certificate has expired or is not yet valid
• 403.18 – Cannot execute request from that application pool
• 403.19 – Cannot execute CGIs for the client in this application pool
• 403.20 – Passport logon failed
• 403.21 – Source access denied
• 403.22 – Infinite depth is denied
• 403.502 – Too many requests from the same client IP; Dynamic IP Restriction limit reached
• 403.503 – Rejected due to IP address restriction

See also[edit]

• List of HTTP status codes
• URL redirection

Notes[edit]

References[edit]

External links[edit]

• Apache Module mod_proxy – Forward
• Working with SELinux Contexts Labeling files
• Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content

Introduction

When a web server denies access to a particular webpage or web content, it displays the 403 Forbidden error. Different web servers report different variations of the 403 Forbidden error.

In this article, you will learn what a 403 error is and how to fix it.

The 403 Forbidden error happens when a web server denies access to a webpage to a user trying to access it trough a web browser. The name «403 error» derives from the HTTP status code that the web server uses to describe that type of error.

There are several variations of the error and several reasons why the web server has denied access. The following sections deal with the different ways the error is displayed and its causes.

Common 403 Error Messages

Like with other errors, webmasters can customize how the 403 error is displayed. Its contents also depend on the web server used. That is why there are many different 403 pages across different websites.

Some common 403 error messages are:

• 403 Forbidden
• HTTP 403
• Forbidden
• HTTP Error 403 – Forbidden
• HTTP Error 403.14 – Forbidden
• Error 403
• Forbidden: You don’t have permission to access [directory] on this server
• Error 403 – Forbidden
• 403 Forbidden Error
• 403 Error

The image above shows an example of a 403 Forbidden error served by an Nginx web server.

What Causes the 403 Forbidden Error

The 403 Forbidden error usually occurs due to access misconfiguration. The misconfiguration involves improper read, write, or execute permission settings for a file or directory.

Possible causes for the 403 Forbidden error are:

• An empty website directory. If there is no index.php or index.html page, the 403 error displays.
• Missing index page. The 403 error may occur if the homepage name isn’t index.html or index.php.
• Permission/ownership errors. Incorrect permission settings or ownership cause the 403 error.
• Incorrect .htaccess file settings. The .htaccess file holds important website configuration settings, and it could be corrupted.
• Malware infection. If your files are infected with malware, it can keep corrupting the .htaccess file.
• Cached outdated webpage. The 403 error comes up if the page link has been updated, which is now different from the cached version.
• Faulty plugin. Improperly configured WordPress plugins or their incompatibility could trigger the 403 error.

The following section deals with different ways of fixing the 403 Forbidden error.

How to Fix the 403 Forbidden Error (Tips for Webmasters)

You can do several things to fix the 403 Forbidden error, depending on whether you are a website visitor or a webmaster.

The following fixes for the 403 Forbidden error are resources for site webmasters:

Check Website Directory

An empty website directory may cause the 403 error. Make sure that the content is in the correct directory on the server.

Depending on the server you are using, the correct directory for your content is:

• For Nginx: /var/www/vhosts/domain.com/httpdocs/
• For Apache: /home/username/public_html/

If there is no such directory, create one.

Add an Index Page

The website homepage by default is index.html or index.php. If there is no such page on your website, the visitors can encounter a 403 Error. Resolve this by uploading an index page to your httpdocs or public_html directory.

If you already have a homepage named other than index, you can rename it or set up a redirect in your .htaccess file to that homepage.

To redirect to your homepage, follow the steps below:

1. Log in to cPanel and navigate to your public_html directory.

2. Right-click the .htaccess file and choose Edit from the dropdown menu.

3. Redirect the index.php or index.html file to your existing homepage by inserting the following code snippet:

redirect /index.html /homepage.html

Replace homepage.html with the actual name of your page.

Check File and Directory Permissions

Each file and directory on your website have permissions that control access to those files and directories. Incorrect file or directory permissions can cause the 403 Forbidden error. The permissions specify who has read or write access to the file or directory in question.

The permissions are represented with numeric values. The general practice is to use:

• 755 for directories
• 644 for static content
• 700 for dynamic content

You can change file permissions recursively with the chmod command. If you prefer a GUI, use an FTP client to change file or directory permissions.

Create a New .htaccess File

A 403 error can be the result of improper .htaccess file configuration. The .htaccess file controls the high-level website configuration.

Follow the steps below to check if the .htaccess file is the cause of the 403 error:

1. Find the .htaccess file via your file management software (e.g., cPanel) or via an sFTP or FTP client.

2. Right-click the .htaccess file and select Download to create a local backup.

3. Next, click Delete to delete the file.

4. Visit your website. If the 403 error no longer appears, it means that the .htaccess file was corrupt.

5. Now you need to generate a new .htaccess file. Log in to your dashboard and click Settings > Permalinks.

6. Don’t make any changes. Just click the Save Changes button to create a new .htaccess file.

Visit your website to check if the error is fixed.

Enable Directory Browsing

If the website shows a 403 error when you’re trying to browse a directory, you may need to enable directory browsing in your web server software. You can turn on directory browsing in the config file. If you don’t feel confident editing the config files yourself, seek help from a web master or your hosting provider.

The following examples show how to enable directory browsing in different web servers:

• IIS Express

1. Open the Web.config file of your project.

2. Add the following tags within <system.webServer>:

<directoryBrowse enabled="true" />
<modules runAllManagedModulesForAllRequests="true" />

• Nginx

Change the autoindex value to on in the config file:

The following is an example of the config file with the on value for autoindex.

server {
 listen 80;
 server_name phoenixnap.com www.phoenixnap.com;
 access_log /var/...........................;
 root /path/to/root;
 location / { index index.php index.html index.htm; }
 location /somedir { autoindex on; }
}

Apache

You have to specify the DirectoryIndex directive in the site’s .conf file (found in /etc/apache2/sites-available on Linux).

Turn on directory browsing in the Options directive. Following is an example of the .conf file with directory browsing turned on:

<Directory /usr/local/apache2/htdocs/listme>
  Options +Indexes
</Directory>

Contact the Hosting Company

The reason for the 403 Forbidden error could be with the hosting company and not with you. If everything else fails to remove the error, get in touch with your hosting company and let them check what could be causing the issue.

Disable WordPress Plugins

Sometimes, a faulty or incompatible plugin is what causes a 403 forbidden error. You can try to fix the error by disabling all plugins to check if the error goes away.

Follow the steps below to disable all plugins:

1. Log into the WP Admin and navigate to Plugins > Installed Plugins.

2. Select all plugins, choose Deactivate from the drop-down menu and click Apply.

3. Try to access your website. If there is no 403 forbidden error, that means that the cause was one of the plugins.

4. Now enable one plugin at a time to determine which one is causing the 403 error. When you find the root of the problem, update or remove the plugin or install an alternative one to resolve the issue.

Check the A Record

One of the reasons for the 403 Forbidden error can be a domain name pointing to the wrong IP address, where you don’t have the permission to view the content. This happens when the A record of a migrated website still points to the old IP address.

Follow the steps below to check if the domain A record points to the right IP address:

1. Log in to cPanel.

2. In the Domains section, click DNS Zone Editor.

3. In the list of DNS records, find the record with the A label in the Type column.

4. Check if the A record IP address in the Record column is correct. If it’s wrong, click Edit to change it.

5. Click Update to finish.

Revisit the website to see if the issue has been resolved.

Scan for Malware

Having malware on your web server can cause the 403 Forbidden error. The malware can keep injecting unwanted lines into the .htaccess file, and that way the error persists even if you generate a new .htaccess file.

Use a security plugin to scan your web server for malware and remove it if any is found. Most plugins also offer actions when detecting malware infected files, such as deleting the infected file or restoring it.

Some of the best security plugins for WordPress are Sucuri, Wordfence, Defender, etc.

How to Fix the 403 Forbidden Error (Tips for Site Visitors)

If you are a site visitor that has encountered the 403 error, below is a list of things you can try to fix the issue.

Check URL

A wrong URL is a common cause of the 403 Forbidden error. Make sure that you’re trying to access an actual webpage instead of a directory.

Many websites don’t allow visitors to browse through directories, so if you are trying to acces a directory, you will likely get a 403 Forbidden error.

Clear History/Cache

Your browser stores cached webpages to load them faster the next time you visit them. Sometimes the website link has been updated, making the actual link different from the cached version. Loading the cached version then results in a 403 error.

The stored cookies on your browser can also cause the 403 error. If the cookies are invalid or corrupted, they can cause improper server authentication. Clearing browser cache and cookies should resolve this issue.

Follow the steps below to clear the cache and cookies on Google Chrome:

1. Click the three-dot button on the top right corner and select Settings.

2. Find the Privacy and security section and click Clear browsing data.

1. In the drop-down menu, select the data deletion time frame.
2. Check the Cookies and other site data and Cached images and files options and click Clear data.

Try to reload the site to see if the problem persists.

Log in

A 403 Forbidden error code could sometimes appear because you need to log in to a website to access a page. If possible, log in with your credentials to gain access to the content.

Reload the Page

Sometimes, reloading the page is the trick to getting around the 403 Forbidden error. Each browser has its own reload button near the address bar. Press Ctrl+F5 on Windows and Linux or Cmd+Shift+R on Mac to reload the page if you prefer using the keyboard.

Try Later

If you aren’t the only one denied access to the website, then the problem is usually with the host. Revisit the site later and see if the issue has been resolved.

Contact Your ISP

If you cannot get around the 403 error on a website, but it works for other people, contact your internet service provider (ISP).

Your IP address could be added to a blocklist, and it is causing the 403 forbidden error. In that case, your ISP cannot help you, and the only way to access the website is to use a VPN.

Conclusion

High website availability provides the best user experience and shows reliability. That is why website owners try to keep their site available at all times and invest in website maintenance services.

Preventing or quickly resolving HTTP errors is crucial if you want to retain your visitors. After reading this guide, you should be able to promptly fix the 403 Forbidden error and keep your business running.

• Blog
• HTTP 403 FORBIDDEN

(21 votes, average: 4.43 out of 5)

• May 20, 2022
• by Admin

It is quite frustrating to be denied access to the information you need especially on your website. You may have been logging in with no problems, and then one day, you receive the ‘access denied’ notification.

The server informs you that you do not have permission to access your website! An HTTP 403 Forbidden code is sent and you have to figure out how to get around it. What is a 403 error response?

An HTTP 403 code means that the server understood the request but will not process it. If the server wants to make known why a request is forbidden, it can provide the reason in the payload. The server may consider the authentication codes supplied in the request inadequate.

The client should avoid the same request with the same codes. However, the client may create the same request using different or new credentials. A server may still send an HTTP 403 forbidden error code for reasons that have nothing to do with the credentials.

Code References

The code references look like this:

Rails HTTP Status Symbol: forbidden

Go HTTP Status Constant http.StatusForbidden

Symfony HTTP Status Constant Response::HTTP_FORBIDDEN

Python2 HTTP Status Constant httplib.FORBIDDEN

Python3+ HTTP Status Constant http.client.FORBIDDEN

Python3.5+ HTTP Status Constant http.HTTPStatus.FORBIDDEN

What is the 403 Forbidden Error?

HTTP status codes are used to provide information about requests made by a client. Apart from the 403 Forbidden error code, there are others such as 100, 200, 300, 400, and more.

A 403 Forbidden error response may look like this:

HTTP 1.1 403 Forbidden

Date: Fri, 30 Nov 2018 09: 19: 02 GMT

Web servers provide requested data in a variety of ways. The data or resources may be presented in URLs that refer to the source. Sometimes, the resources requested may be denied. A 403 Forbidden response is issued in such an instance.

If the access requires further authentication, a 402 response is generated.

So, what does 403 Forbidden mean? As mentioned in the intro, HTTP 403 forbidden error means the server acknowledges the request but refuses to process it. This status is much like the 401 code. The difference is that re-authentication will not produce positive results with the 403 code.

Access is completely banned. The reason provided is insufficient authentication codes. Naturally, this can be perturbing especially if you run the site and have no problem accessing it previously.

HTTP Status 403 forbidden Specification

HTTP 403 presents a unique error case in the sense that it is returned when the client is denied access to resources it requested. HTTP 401, on the other hand, is returned when the client fails to provide valid authentication. Once that is presented, the client will be allowed access.

The 403 code denies access and the reason given is that the credentials presented are not sufficient.

Substatus Error Codes of IIS

IIS describes nonstandard error codes that furnish the user with a particular reason for the 403 code response. A 403 code refuses re-authentication. The 401 code, on the other hand, insinuates that re-authentication may result in positive results if the credentials provided in the request are valid.

The response given must include a www-Authenticate header field that includes a challenge appropriate to the resource requested. The client may create the same request with a valid Authorization header field.

If the request contained Authorization codes, then the 401 code response may cite the codes as the reason for the response.

The client may request a URL path that corresponds to file system directories when directory listings have been disabled in the server. Also, there may be no directory index that determines a current file to be returned to the browser.

In either instance, the result will most likely be a 403 error code response from an Apache web server. Therefore, when you see a response such as 403 forbidden access is denied, or its variations, you have an inkling why,

Some administrations set up the Mod_proxy to Apache to reject such requests. This also results in a 403 code response. Microsoft IIS responds in a similar fashion when directory listings are rejected in that server.

Microsoft’s IIS returns the following nonstandard codes:

• 403.1 Execute access forbidden.
• 403.2 Read access forbidden.
• 403.3 Write access forbidden.
• 403.4 SSL required
• 403.5 SSL 128 required.
• 403.6 IP address rejected.
• 403.7 Client certificate required.
• 403.8 Site access denied.
• 403.9 Too many users.
• 403.10 Invalid configuration.
• 403.11 Password change.
• 403.12 Mapper denied access.
• 403.13 Client certificate revoked.
• 403.14 Directory listing denied.
• 403.15 Client Access Licenses exceeded.
• 403.16 Client certificate is untrusted or invalid.
• 403.17 Client certificate has expired or is not yet valid.
• 403.18 Cannot execute requests from that application pool.
• 403.19 Cannot execute CGIs for the client in this application pool.
• 403.20 Passport login failed.
• 403.21 Source access denied.
• 403.22 Infinite depth is denied.
• 403.502 Too many requests from the same client IP; Dynamic IP Restriction limit reached.
• 403.503 Rejected due to IP address restriction
• Icon Internet portal
• .htaccess
• List of HTTP status codes
• URL redirection

Why Am I Seeing a 403 Forbidden Error Message?

There are several reasons why you may be seeing a 403 Forbidden error message. The most obvious reason is that access to the page you requested has been denied. The server tells you that you do not have permission to access the page you asked for.

Three other common reasons for these particular error codes include the following:

A website Directory is Empty

In this case, check whether your site content is uploaded to the right directory. To access this information, type the following in your search bar:

Plesk server: /var/www/vhosts/example.com/httpdocs/

Once you connect to your FTP user, you can easily navigate browse to the httpdocs directory. Do not forget to include your actual domain name.

cPanel server: /home/example/public_html/

From your FTP user, you can connect to your public_html directory. Remember to erase the example and input the name of your cPanel account username.

Ownership or Permission Error

If the ownership or permissions on your site are incorrect, simply correct them.

Missing Index page

Your site’s home page is named index.html or index.php. If the page is missing, upload an index page to your httpdocs/public_html directory. If your home page goes by a different name, you can:

• Rename it
• Create a redirect on your index page to the real home page
• Create a different home page in your .htaccess file.

How to Fix a 403 Forbidden Error Message

When the response is you ‘are not allowed to use the server’, a user can be dismayed. Fortunately, it is possible to fix the problem.

First off, how does the 403 Forbidden error appear? Different servers present 403 Forbidden errors in different ways. Some servers customize the site’s HTTP 403 Forbidden error. However, these are few and far between.

Here are a few manifestations of the error message on a variety of servers:

• Forbidden
• HTTP 403
• HTTP 403.14-Forbidden
• HTTP Error 403-Forbidden
• 403 Forbidden
• Error 403
• Forbidden: You don’t have permission to access (directory) on this server
• Error 403-Forbidden

The error code appears inside the browser window and can be viewed in any browser on every operating system.

The Internet Explorer carries ‘The website declined to show this webpage’ option. This is a 403 Forbidden error message. When you open links in Microsoft Office programs, you may get ‘Unable to open URL. Cannot download the information you requested’.

Fixing the 403 Forbidden Error

Here are a few pointers on how to fix a 403 Forbidden error on your server.

Check for URL Errors: Ensure that you have identified a specific web page file name as well as the extension. A directory alone will not do. The number one reason for the 403 error code is directory browsing. Lots of websites are configured to prevent it.

Hence, the error code will pop up when attempting to present a folder instead of a particular page. If you operate the website that refuses to open, enable directory browsing in your web server. This will prevent HTTP status 403 forbidden error responses.

Clean up Your Browser’s cache: If you have cached a version of the page you are looking for, this could be the problem. A cache clean could be the perfect 403 error fix that your server needs.

Try Logging into the Website: If it is possible and appropriate, log into the website. The error code could simply mean that you need further access before you are allowed to view the page. Normally, a 401 error is generated by a website that demands special permission.

Clear Your Browser’s Cookies: This is especially necessary if you log into the website but your last attempt was unsuccessful. However, ensure the cookies are enabled on your browser. The 403 error message is also an alert that cookies may be involved in gaining proper access.

Contact the Website: The 403 Forbidden response may be a mistake. You and others may be seeing it but the site may be unaware that there is a problem. How do you find out if the error is seen by everyone, not just you?

Many websites run support-based accounts on social media platforms. This makes it easy to access them as users can simply click on the link provided. Several sites also provide contact details such as phone numbers and email addresses.

You may come across a thread on Twitter or Facebook discussing a site that has gone down. That is one way to know that a website is not accessible. If your website is popular, you will easily know if others cannot access it as users will be asking why.

Reach Out to Your Internet Provider: If others can easily access your website, the problem may be your internet provider. You may discover that your public IP address or ISP has been blacklisted for some reason. This may explain the 403 forbidden error response.

Revisit the Page Regularly: If you have ascertained that the page you are trying to access is the correct one, leave it for a while. Try to access it later and regularly until the issue is resolved. This is also an excellent option if you have established that the error is seen by everyone.

Other errors that look like the 403 Forbidden response include the following:

• 400 Bad Request
• 404 Not Found
• 408 Request Timeout

Slot Online

These are client-side errors that may be caused by client-related issues. There are code errors that are server-related as well. These include the following:

• 500 Inter Server Error
• 502 Service Unavailable
• 503 Bad gateway
• 504 Gateway Timeout

Ultimately, if you get a 403 Forbidden error response, there are some steps you can take to rectify it and access the information you need. In addition, it is possible to diagnose the problem and find solutions.

If the error code is visible to everyone, you may need to conduct some diagnostics to figure out what is wrong. If it is visible to you alone, then your service provider may provide a solution.

Http Error 533

Related Resources

Website virus scanner

Web Hosting

Free Website Hosting

Did you just try to access your WordPress site only to be hit by some message telling you something is “Forbidden” or that you don’t have permission to access something on your site? If so, you’ve likely run into the 403 Forbidden error on WordPress.

Seeing an error on your WordPress site can be frustrating and deflating, which is why we’ve created this detailed guide to help you fix the 403 Forbidden Error on WordPress and get your site functioning again as quickly as possible.

Let’s get started without any further introduction because we’re sure you just want to fix your site!

Prefer the video version?

What is the 403 Forbidden Error?

The Internet Engineering Task Force (IETF) defines the error 403 Forbidden as:

The 403 (Forbidden) status code indicates that the server understood the request but refuses to authorize it. A server that wishes to make public why the request has been forbidden can describe that reason in the response payload (if any).

Error Code	403
Error Type	Authentication error
Error Variations	Forbidden – You don’t have permission to access / on this server 403 – Forbidden: Access is denied Error 403 – Forbidden 403 – Forbidden Error – You are not allowed to access this address 403 Forbidden – nginx HTTP Error 403 – Forbidden – You do not have permission to access the document or program you requested 403 Forbidden – Access to this resource on the server is denied 403. That’s an error. Your client does not have permission to get URL / from this server You are not authorized to view this page It appears you don’t have permission to access this page
Error Causes	Corrupt .htaccess file Incorrect file permissions Plugin issues

Like many other common WordPress errors, the 403 Forbidden error is an HTTP status code that a web server uses to communicate with your web browser.

Quick background on HTTP status codes – whenever you connect to a website with your browser, the web server responds with something called an HTTP header. Usually, this all happens behind the scenes because everything is working normally (that’s a 200 status code, in case you were wondering).

However, if something goes wrong, the server will respond back with a different numbered HTTP status code. While these numbers are frustrating to encounter, they’re actually quite important because they help you diagnose exactly what’s going wrong on your site.

The 403 Forbidden error means that your web server understands the request that the client (i.e. your browser) is making, but the server will not fulfill it.

In more human-friendly terms, it basically means that your server knows exactly what you want to do, it just won’t let you do it because you don’t have the proper permissions for some reason. It’s kind of like you’re trying to get into a private event, but your name got accidentally removed from the guestlist for some reason.

Other HTTP status codes mean different things. We’ve written guides on fixing issues with 404 not found errors, 500 internal server errors, 502 bad gateway errors, and 504 gateway timeout errors.

What Causes the 403 Forbidden Error on WordPress?

The two most likely causes of the 403 Forbidden Error on WordPress are:

1. Corrupt .htaccess file
2. Incorrect file permissions

It’s also possible that you’re seeing the error because of an issue with a plugin that you’re using at your site. In this article, we’ll show you how to troubleshoot all of these potential issues.

403 Forbidden Error Variations

Like many other HTTP status codes, there are a lot of different variations for how this error code presents itself.

Here are some common variations that you might come across:

• “Forbidden – You don’t have permission to access / on this server”
• “403 – Forbidden: Access is denied”
• “Error 403 – Forbidden”
• “403 – Forbidden Error – You are not allowed to access this address”
• “403 Forbidden – nginx”
• “HTTP Error 403 – Forbidden – You do not have permission to access the document or program you requested”
• “403 Forbidden – Access to this resource on the server is denied”
• “403. That’s an error. Your client does not have permission to get URL / from this server”
• “You are not authorized to view this page”
• “It appears you don’t have permission to access this page.”

If you’re on an Nginx server, it will look like this below. Basically, if you see any mention of “forbidden” or “not allowed to access”, you’re probably dealing with a 403 Forbidden error.

How to Fix 403 Forbidden Error on WordPress

To help you fix the 403 Forbidden Error on your WordPress site, we’ll cover five separate troubleshooting steps in detail:

• File permissions
• .htaccess file
• Plugin issues
• CDN issues
• Hotlink protection

1. Modify Your File Permissions

Each folder and file on your WordPress site’s server has its own unique file permissions that control who can:

• Read – see the data in the file/view the contents of a folder.
• Write – modify the file/add or delete files inside a folder
• Execute – run the file and/or execute it as a script/access a folder and perform functions and commands.

These permissions are indicated by a 3-digit number, with each digit indicating the level of permission for each of the 3 categories above.

Normally, these permissions just “work” for your WordPress site. However, if something gets messed up with the file permissions at your WordPress site, it can cause the 403 Forbidden error.

To view and modify your site’s file permissions, you’ll need to connect via FTP/SFTP. Here’s how to use SFTP if you’re hosting at Kinsta.

For the screenshots in the tutorial below, we’ll be using the free FileZilla FTP program. The basic principles will apply to any FTP program, though – you’ll just need to apply them to a different interface.

Once you’re connected to your server, you can view a file or folder’s permissions by right-clicking on it:

Of course, manually checking the permissions for each file or folder isn’t really an option. Instead, you can automatically apply file permissions to all the files or folders inside of a folder.

According to the WordPress Codex, the ideal file permissions for WordPress are:

• Files  – 644 or 640
• Directories – 755 or 750

One exception is that your wp-config.php file should be 440 or 400.

To set these permissions, right-click on the folder that contains your WordPress site (the folder name is public at Kinsta). Then, choose File Attributes:

Enter 755 or 750 in the Numeric value box. Then, choose Recurse into subdirectories and Apply to directories only:

Once you’ve applied the correct permissions for directories, you’ll repeat the process for files. Only this time:

• Enter 644 or 640 in the Numeric value box
• Choose Recurse into subdirectories
• Choose Apply to files only

To finish the process, you just need to manually adjust the permissions for your wp-config.php file to make them 440 or 400:

If file permissions issues were causing the 403 Forbidden Error, your site should now start working again.

2. Delete and Restore the .htaccess File

Kinsta uses the NGINX web server, so this potential issue doesn’t apply if you’re hosting your site at Kinsta because Kinsta sites do not have a .htaccess file.

However, if you’re hosting elsewhere and your host uses the Apache web server, one common cause of the 403 Forbidden error is a problem in your site’s .htaccess file.

The .htaccess file is a basic configuration file used by the Apache web server. You can use it to set up redirects, restrict access to all or some of your site, etc.

Because it’s so powerful, even if a little mistake can cause a big issue, like the 403 Forbidden error.

Rather than trying to troubleshoot the .htaccess file itself, a simpler solution is to just force WordPress to generate a new, clean .htaccess file.

To do that:

• Connect to your server via FTP
• Find the .htaccess file in your root folder
• Download a copy of the file to your computer (it’s always a good idea to have a backup just in case)
• Delete the .htaccess file from your server after you have a safe backup copy on your local computer

Now, you should be able to access your WordPress site if your .htaccess file was the issue.

To force WordPress to generate a new, clean .htaccess file:

• Go to Settings → Permalinks in your WordPress dashboard
• Click Save Changes at the bottom of the page (you do not need to make any changes – just click the button)

And that’s it – WordPress will now generate a new .htaccess file for you.

3. Deactivate and then Reactivate Your Plugins

If neither your site’s file permissions nor .htaccess file are the problems, the next place to look is your plugins. It could be a bug in a plugin or a compatibility issue between different plugins.

No matter what the issue is, the easiest way to find the problematic plugin is with a little trial and error. Specifically, you’ll need to deactivate all of your plugins and then reactivate them one by one until you find the culprit.

If you can still access your WordPress dashboard, you can perform this process from the normal Plugins area.

If you cannot access your WordPress dashboard, you’ll instead need to connect to your WordPress site’s server via FTP/SFTP (here’s how to connect via SFTP at Kinsta).

Once you’re connected to your server via FTP:

1. Browse to the wp-content folder
2. Find the plugins folder inside of the wp-content folder
3. Right-click on the plugins folder and choose Rename
4. Change the name of the folder. You can name it anything different, but we recommend something like plugins-disabled to make it easy to remember.

By renaming the folder, you’ve effectively disabled all the plugins at your site.

Now, try accessing your site again. If your site is working, you know that one of your plugins is causing the 403 Forbidden error.

To find the culprit, reactivate your plugins one-by-one until you find which plugin is causing the issue.

After changing the file name of the plugins folder, you should see a number of errors that say plugin file does not exist when you go to the Plugins area on your site:

To fix this issue and regain the ability to manage your plugins, use your FTP program to change the name of the folder back to plugins. So, if you renamed it to plugins-disabled, just change it back to plugins.

Once you do that, you’ll see the full list of all your plugins again. Only now, they’ll all be deactivated:

Use the Activate button to reactivate them one-by-one.

Once you find the plugin that’s causing the issue, you can either reach out to the plugin’s developer for help or choose an alternate plugin that accomplishes the same thing (we’ve collected the best WordPress plugins here).

4. Deactivate CDN Temporarily

If you’re getting 403 forbidden errors on your assets (images, JavaScript, CSS), it could be a problem with your content delivery network (CDN). In this case, we recommend temporarily disabling your CDN and then checking your site to see if it works. If you’re a Kinsta client, click into your site and then on the “Kinsta CDN” tab. Once there, toggle the “Kinsta CDN” button off.

5. Check to See If Hotlink Protection Is Misconfigured

Hotlinking is when someone adds an image to their site, but the hosted link is still pointed to someone else’s site. To prevent this, some will set up what is called “hotlink protection” with their WordPress host or CDN provider.

When hotlink protection is enabled, it will typically return a 403 forbidden error. This is normal. However, if you’re seeing a 403 forbidden error on something you shouldn’t be, check to make sure hotlink protection is configured properly.

Still Having Issues? Reach Out to Your Hosting Provider

If none of the above solutions worked for you, then we recommend reaching out to your hosting provider. They can most likely help you pinpoint the issue and get you back up and running. If you’re a Kinsta client, open up a support ticket with our team. We are available 24/7.

Summary

The 403 Forbidden error means that your server is working, but you no longer have permission to view all or some of your site for some reason.

The two most likely causes of this error are issues with your WordPress site’s file permissions or .htaccess file. Beyond that, some plugin issues might also cause the 403 Forbidden error. Or it could be that something is misconfigured with hotlink protection or your CDN.

By following the troubleshooting steps in this guide, you should be able to get your site back to working in no time.