--- title: "How to fix the 403 Forbidden error in WordPress" url: https://wpministry.co/errors/403-forbidden/ description: "A 403 means the server refused the request. On WordPress the refusal comes from .htaccess, a security plugin, file permissions or the host's firewall." lang: en-US --- Skip to content # How to fix the 403 Forbidden error in WordPress A 403 means the server understood the request and refused it. On a WordPress site the refusal comes from a rule in .htaccess, a security plugin, file permissions or the host's firewall. Who is refused, and on which pages, tells you which one to look at. By WP Ministry Published October 6, 2026 Tested on WordPress 7.1.4, PHP 8.3.36 ## In short - A 403 is a refusal, not damage. Your content has not been touched. - If the site loads for other people and not for you, your address has been blocked by a security plugin or by the host. - If everyone is refused on every page, look at .htaccess first, then at file permissions. - Never set files or folders to 777 to get past a 403. "403 Forbidden" is the server saying that it understood the request and will not answer it. Logging in again makes no difference. A 404 (https://wpministry.co/errors/404-not-found/) means the page could not be found. A 403 means something decided you may not have it: a rule in a file, a plugin, a permission or a firewall. Your posts, pages and settings are not affected. ## Find out who is refusing you - **Does the site load on another connection?** Try your phone on mobile data. If it loads there, your own address is blocked: start with the security plugin, then ask the host. - **Does it only happen when you save, upload or send a form?** The host's firewall is refusing that one request. Go to the last fix. - **Is everyone refused, on every page?** Look at `.htaccess`, then at permissions. The page itself is a clue. A plain page that says "Forbidden" and "You don't have permission to access this resource." comes from the web server. A page that carries a product's name comes from that plugin or service. ## Where it goes wrong A page request passes through each of these in turn. This one comes from **the web server**. 1. Browser 2. DNS 3. HTTPS 4. CDN or firewall 5. Web server (this error comes from here) 6. PHP 7. WordPress 8. Database and files ## What causes it - ### A rule in .htaccess turns visitors away Common A line added by a plugin or by hand tells the web server to refuse everyone, or to let in a single address that is no longer yours. Fix: Replace .htaccess with WordPress's standard one - ### A security plugin has blocked you Common Security plugins lock out an address after failed logins, and can block by country or by rule. The page they show usually carries the plugin's name. Fix: Switch off the security plugin that blocked you - ### The web server cannot read a file or open a folder Sometimes After a move, a restore or a bulk change, files and folders can carry permissions that shut the web server out. It refuses to serve what it cannot read. Fix: Set folders to 755 and files to 644 - ### The host's firewall is refusing the request Sometimes The hosting company's firewall has blocked your address, or one of its rules has mistaken an ordinary request, such as saving a post, for an attack. Fix: Ask the host to check its firewall ## How to fix it ### Replace .htaccess with WordPress's standard one - Easy - Back up first - About 5 minutes - Steps tested on WordPress 7.1.4 This applies to sites on Apache or LiteSpeed. nginx has no `.htaccess` file. 1. #### Step 1: Download a copy of .htaccess It sits in the site's main folder, beside `wp-config.php`. Its name begins with a dot, so turn on "Show hidden files" in your file manager if you cannot see it. 2. #### Step 2: Look for a line that refuses `Deny from all`, `Require all denied`, or `Require ip` followed by an address all tell the server to turn visitors away. The last one lets in only the address it names. 3. #### Step 3: Replace everything in the file with this This is what WordPress itself writes for a site at the root of its domain. .htaccess Copy ``` # BEGIN WordPress RewriteEngine On RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteBase / RewriteRule ^index\.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] # END WordPress ``` 4. #### Step 4: Reload the site If it loads, a line in the old file was refusing you. Put your other rules back one section at a time from the copy, and leave out the one that brings the 403 back. If WordPress is installed in a subfolder, such as `example.com/blog`, do not paste the block above. Rename `.htaccess` to `.htaccess-old`, then go to Settings, then Permalinks in the dashboard and press Save Changes. WordPress writes a fresh file with the right paths. **To undo it:** Put your copy of the old .htaccess back. ### Switch off the security plugin that blocked you - Takes care - Low risk - About 10 minutes - Steps tested on WordPress 7.1.4 1. #### Step 1: Rename the plugin's folder In your host's file manager or over SFTP, open `wp-content/plugins/` and add `-off` to the name of the security plugin's folder. WordPress can no longer find the plugin, so it stops running. 2. #### Step 2: Reload the site and log in If the site loads, that plugin was refusing you. Open the Plugins screen once, so that WordPress records the plugin as switched off. 3. #### Step 3: Put the plugin back and clear the block Rename the folder back and activate the plugin. Go straight to its settings and take your address off its block list, or add it to the list of addresses it always allows. With WP-CLI, use the plugin's folder name: bash ``` wp plugin deactivate plugin-folder-name ``` Switching the plugin off keeps its settings, its block list included, so it may lock you out again when it is back on. If it does, switch it off the same way and ask the plugin's support how to clear the block. **To undo it:** Rename the folder back, or activate the plugin again. ### Set folders to 755 and files to 644 - Takes care - Low risk - About 15 minutes - Steps tested on WordPress 7.1.4 The web server has to be able to open every folder and read every file. WordPress's own guidance is 755 for folders and 644 for files. 1. #### Step 1: Check the main folder first In your file manager or SFTP program, look at the permissions of the site's main folder, of `wp-admin`, `wp-content` and `wp-includes`, and of `.htaccess` and `index.php`. A folder that is not 755, or a file that is not 644, is a likely cause. 2. #### Step 2: Set folders to 755 and files to 644 Most file managers and SFTP programs can apply a permission to everything inside a folder, to folders only or to files only. Do the folders first, then the files, then reload the site. Over SSH, run these two commands from the site's main folder. The first sets every folder, the second every file. bash ``` find . -type d -exec chmod 755 {} \; find . -type f -exec chmod 644 {} \; ``` If your host told you to keep `wp-config.php` tighter than 644, set that again afterwards. Do not set anything to 777. It lets every account on the server change your files. If the numbers were already right, the files may belong to the wrong user on the server. Only the host can change that. ### Ask the host to check its firewall - Easy - No risk - About 15 minutes Many hosts run a web application firewall, often ModSecurity, in front of every site. It blocks addresses that look hostile and requests that look like attacks. A post that contains code can trip a rule by mistake. 1. #### Step 1: Write down what happened Note the address of the page, the time, what you were doing and your own IP address. Searching the web for "what is my IP" shows it. 2. #### Step 2: Send that to the host's support Ask whether your IP address is blocked, and whether a firewall rule refused the request at that time. They can see the rule in their log and can lift the block or switch that rule off for your site. ## When to get help If .htaccess is the standard one, folders are 755 and files 644, your security plugin is switched off and the 403 is still there, the refusal comes from the host's firewall or the server's own configuration. Only the host, or someone with access to the server, can see which rule it is. ## Common questions A folder address such as /wp-content/uploads/ shows 403. Is something wrong? No. When a folder has no index file and the server is set not to list what is in it, a 403 is the correct answer. The files inside still load by their own addresses. Why am I the only one who sees the 403? Your address has been blocked, by a security plugin after failed logins or by the host's firewall. Check from another connection to confirm it, then use the second and fourth fixes. Only the login page shows 403. Why? Some `.htaccess` rules refuse only one file, such as `wp-login.php`, to every address but one. If your own address has changed since the rule was written, it now refuses you. The first fix removes it. If the login page loads but will not let you in, see the login page that keeps reloading (https://wpministry.co/errors/login-page-refreshing-and-redirecting/). ## More on this subject - WordPress errors and troubleshooting: https://wpministry.co/topics/wordpress-troubleshooting/ - Guide WordPress uptime monitoring: what a check sees and what it misses: https://wpministry.co/blog/wordpress-uptime-monitoring/ - Guide How to update the PHP version of a WordPress site: https://wpministry.co/blog/update-php-version-wordpress/ - Glossary term REST API: https://wpministry.co/glossary/rest-api/ - Guide Slow WordPress admin: how to find the cause and fix it: https://wpministry.co/blog/slow-wordpress-admin/ - Resource WooCommerce checkout is down: a runbook: https://wpministry.co/resources/woocommerce-checkout-down-runbook/ - Guide WordPress site not showing up on Google: what to check, in order: https://wpministry.co/blog/wordpress-site-not-on-google/ ## Would you rather we fixed it? Emergency Fix is $99. Site down or checkout broken. Goes to the front of the queue. No fix, no fee. 30-day warranty. More about this work: Emergency WordPress support (https://wpministry.co/services/emergency-support/) May we measure how this site is used? A yes notes the pages of this visit and loads Google Analytics. A no keeps and loads nothing. See the cookies page (https://wpministry.co/legal/cookies/). If you say yes, we note the pages you look at during this visit and load Google Analytics. If you say no, nothing is kept and nothing is loaded. The site works the same either way. The cookies page (https://wpministry.co/legal/cookies/) has the details. ## Structured data ```json { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://wpministry.co/#organization", "name": "WP Ministry", "url": "https://wpministry.co/", "logo": "https://wpministry.co/brand/logo.png", "address": { "@type": "PostalAddress", "streetAddress": "1309 Coffeen Ave STE 1200", "addressLocality": "Sheridan", "addressRegion": "WY", "postalCode": "82801", "addressCountry": "US" }, "sameAs": [ "https://www.linkedin.com/company/wp-ministry/", "https://x.com/wpministryco", "https://www.instagram.com/wpministryco/", "https://www.facebook.com/wpministryco", "https://www.tiktok.com/@wpministryco", "https://www.pinterest.com/wpministryco/", "https://www.youtube.com/channel/UCOZRuAukk5QSTRPG6BaHl3Q" ] }, { "@type": "WebSite", "@id": "https://wpministry.co/#website", "name": "WP Ministry", "url": "https://wpministry.co/", "inLanguage": "en-US", "publisher": { "@id": "https://wpministry.co/#organization" } }, { "@type": "TechArticle", "@id": "https://wpministry.co/errors/403-forbidden/#article", "headline": "How to fix the 403 Forbidden error in WordPress", "description": "A 403 means the server refused the request. On WordPress the refusal comes from .htaccess, a security plugin, file permissions or the host's firewall.", "url": "https://wpministry.co/errors/403-forbidden/", "mainEntityOfPage": "https://wpministry.co/errors/403-forbidden/", "inLanguage": "en-US", "image": "https://wpministry.co/og/errors/403-forbidden.png", "author": { "@id": "https://wpministry.co/#organization" }, "publisher": { "@id": "https://wpministry.co/#organization" }, "datePublished": "2026-10-06T00:00:00.000Z", "dateModified": "2026-10-06T00:00:00.000Z" }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://wpministry.co/" }, { "@type": "ListItem", "position": 2, "name": "Error fixes", "item": "https://wpministry.co/errors/" }, { "@type": "ListItem", "position": 3, "name": "How to fix the 403 Forbidden error in WordPress" } ] } ] } ```