403 Forbidden Error — How to Fix It

A 403 Forbidden error means the server understood the request but is refusing to serve it. Unlike a 404 (missing), the file is usually there — something is blocking access to it.

The usual causes

• No index file in the folder and directory listing is disabled.
• Wrong file permissions (e.g. a folder set so the web server can't read it, or a file at 0000/0400).
• A security rule — the host's WAF, a plugin, or an IP block — refusing the request.
• A misconfigured .htaccess with deny rules.
• An empty folder being accessed directly (like yourdomain.com/assets/ with no index).

Diagnose it

1. Is it the whole site or one page? One page → permissions, .htaccess or a security block on that path. Whole site → a broader rule or a server-side block.
2. Check permissions. In File Manager, ensure folders are 0755 and files 0644. Undo any accidental chmod 000 or chmod 400 attempt.
3. Look for a folder without an index. Add a welcome page or an empty index.html to stop direct folder access from 403ing.
4. Check .htaccess for Deny from and <Files> blocks that might match the URL.

A special WordPress case: 403 on everything but the home page

Fine at home, 403 on /about/ and other pretty URLs? The rewrite rules in .htaccess are usually the culprit. Reset it (rename the old one away) and regenerate via Settings > Permalinks > Save Changes.

Suspicious of an IP/security block?

Confirm from your phone on mobile data. If it loads there but not on your office network, a security rule tied to IPs is a real possibility — ask support to check the host-level blocklist, and while you're there, ask them to look at the account error log; it records the exact refusal reason for 403s.