Fixing 403 Forbidden errors

403 Forbidden (“You don’t have permission to access this resource”) means the server found the page but isn’t allowed to show it. Check these causes in order.

1. There’s no home page file

If you open your domain and see 403, your website’s folder may have no index file.

1. In cPanel, open File Manager and go to your website’s folder: public_html for your main domain, or the addon domain’s own folder.
2. Check there’s a file called index.php or index.html.

If your files are inside a subfolder (for example public_html/mysite/), move them up into public_html. See Moving a website from a subfolder to the main domain.

2. File or folder permissions are wrong

Files and folders need the right permissions for the server to read them:

Type	Permission
Folders	755
Files	644
wp-config.php and other config files	640 or 600 also work

In File Manager, right-click a file or folder, choose Change Permissions, and set the right number. Never use 777: the server blocks files and folders that anyone can write to.

3. A rule in .htaccess blocks access

1. In File Manager, click Settings and tick Show Hidden Files.
2. Open .htaccess in your website’s folder and look for lines such as Deny from all, Require all denied or IP address rules.
3. To test, rename .htaccess to .htaccess-old and reload your site. If it works, the problem is in that file.

For WordPress, create a fresh .htaccess by going to Settings → Permalinks in your dashboard and clicking Save Changes. Then add back any rules you need.

Also check cPanel’s Directory Privacy and IP Blocker, which can block visitors.

4. A security rule blocked you

If the 403 appears only when you do something, such as save a page, submit a form or log in, a security rule (ModSecurity or Imunify360) may have blocked it as suspicious.

• Wait a few minutes and try again.
• If you entered your password wrongly many times, your IP address may be blocked for a while.
• Open a support ticket with your IP address (search “what is my IP”), the page address and the time it happened. We’ll check the logs and unblock you if it was a false alarm.

5. A plugin is blocking you

WordPress security plugins such as Wordfence can block countries, IP addresses or logins. Turn the plugin off by renaming its folder in wp-content/plugins/, then reload the page.

Still seeing 403?

Open a support ticket with the page address and what you were doing when the error appeared.

Related articles

• About the 403 Forbidden error message
• My website isn’t working. Where do I start?