# Fixing 403 Forbidden errors

> Your website shows "403 Forbidden". Here's how to find the cause, from missing index files and wrong permissions to .htaccess rules and security blocks.

Source: https://helpcenter.ruachost.com/getting-started/website-troubleshooting/fixing-403-forbidden-errors/

**403 Forbidden** ("You don't have permission to access this resource") means the server found the page but isn't allowed to show it. Check these causes in order.

## 1. There's no home page file

If you open your domain and see 403, your website's folder may have no **index file**.

1. In cPanel, open **File Manager** and go to your website's folder: `public_html` for your main domain, or the addon domain's own folder.
2. Check there's a file called `index.php` or `index.html`.

If your files are inside a subfolder (for example `public_html/mysite/`), move them up into `public_html`. See [Moving a website from a subfolder to the main domain](https://helpcenter.ruachost.com/cpanel/files/moving-a-website-from-a-subfolder-to-the-main-domain/).

## 2. File or folder permissions are wrong

Files and folders need the right permissions for the server to read them:

| Type | Permission |
| --- | --- |
| Folders | `755` |
| Files | `644` |
| `wp-config.php` and other config files | `640` or `600` also work |

In File Manager, right-click a file or folder, choose **Change Permissions**, and set the right number. Never use `777`: the server blocks files and folders that anyone can write to.

## 3. A rule in .htaccess blocks access

1. In File Manager, click **Settings** and tick **Show Hidden Files**.
2. Open `.htaccess` in your website's folder and look for lines such as `Deny from all`, `Require all denied` or IP address rules.
3. To test, rename `.htaccess` to `.htaccess-old` and reload your site. If it works, the problem is in that file.

For WordPress, create a fresh `.htaccess` by going to **Settings → Permalinks** in your dashboard and clicking **Save Changes**. Then add back any rules you need.

Also check cPanel's **Directory Privacy** and **IP Blocker**, which can block visitors.

## 4. A security rule blocked you

If the 403 appears only when you do something, such as save a page, submit a form or log in, a security rule (ModSecurity or Imunify360) may have blocked it as suspicious.

- Wait a few minutes and try again.
- If you entered your password wrongly many times, your IP address may be blocked for a while.
- [Open a support ticket](https://dashboard.ruachost.com/submitticket.php) with your IP address (search "what is my IP"), the page address and the time it happened. We'll check the logs and unblock you if it was a false alarm.

## 5. A plugin is blocking you

WordPress security plugins such as Wordfence can block countries, IP addresses or logins. Turn the plugin off by renaming its folder in `wp-content/plugins/`, then reload the page.

## Still seeing 403?

[Open a support ticket](https://dashboard.ruachost.com/submitticket.php) with the page address and what you were doing when the error appeared.

## Related articles

- [About the 403 Forbidden error message](https://helpcenter.ruachost.com/developers/web-servers/about-the-403-forbidden-error-message/)
- [My website isn't working. Where do I start?](https://helpcenter.ruachost.com/getting-started/website-troubleshooting/website-not-working-where-to-start/)