Why Your Website Is Returning 403 Forbidden Errors and How to Fix It

Summary

This guide helps you troubleshoot and resolve: Why Your Website Is Returning 403 Forbidden Errors and How to Fix It. Follow the steps below to fix the issue.

Common Causes

A 403 Forbidden error means your website's server received the request from a visitor's browser but refused to allow access to the requested page or resource. Unlike a 404 Not Found error, the file or page exists, but permissions or security rules are blocking it. For small business owners, this can prevent customers from viewing your homepage, completing checkout flows, or accessing your administrative dashboard.

Quick Fix Steps

1. Refresh the page to confirm the error is persistent and not a temporary glitch.
2. Try accessing your website from a different device or mobile network to rule out a local IP block.
3. Clear your browser cache and cookies, then attempt to load the site again.
4. Check if the error affects your entire website or only specific pages, folders, or file types.
5. Log in to your hosting control panel and review recent changes to file permissions, security plugins, or .htaccess rules.

Detailed Instructions

Check File and Folder Permissions

Incorrect permissions are one of the most common causes of 403 errors. Web servers require specific read and execute permissions to serve files to visitors.

1. Connect to your hosting account using an FTP client or the File Manager in your hosting control panel.
2. Navigate to your website's root directory (commonly public_html, httpdocs, or www).
3. Right-click on folders and select File Permissions or Change Permissions.
4. Set folders to 755 and files to 644. Avoid setting folders to 777, as this is a security risk and many servers will reject it.
5. Apply the changes to folders only, then repeat for files if necessary.
6. Refresh your website to see if the error is resolved.

Review Your .htaccess File

The .htaccess file controls access rules on Apache servers. A misconfigured rule can block all visitors or specific IP addresses.

1. Open File Manager in your hosting control panel or connect via FTP.
2. Locate the .htaccess file in your website root directory. If you cannot see it, enable the option to show hidden files.
3. Download a copy of the file to your computer as a backup.
4. Open the file in a plain text editor and look for lines containing deny from, Require all denied, or RewriteRule directives that may be blocking access.
5. Temporarily rename the file to .htaccess_old and refresh your website.
6. If the site loads, the .htaccess file was causing the issue. Recreate a default .htaccess file or contact your developer to review the rules.

Check Security Plugins and Firewall Rules

If you use a content management system such as WordPress, Joomla, or Drupal, security plugins can mistakenly block legitimate visitors or your own IP address.

1. Log in to your CMS admin dashboard.
2. Navigate to your security or firewall plugin settings.
3. Review the blocked IP list, blacklist, or firewall logs for your own IP address or your visitors' IP ranges.
4. Remove any incorrect blocks and save the changes.
5. If you cannot access the dashboard, connect via FTP and temporarily rename the security plugin's folder in /wp-content/plugins/ (for WordPress) or the equivalent extensions directory for your CMS.

Verify Index Files and Directory Listings

If a visitor requests a folder instead of a specific file, the server looks for a default index file. If none exists and directory browsing is disabled, a 403 error may appear.

1. Ensure your website root contains a default file such as index.html, index.php, or default.aspx.
2. Check that the file is spelled correctly and uses lowercase letters, as Linux servers are case-sensitive.
3. Confirm the file has read permissions set to 644.

Troubleshooting

Error Affects Only One Page or File

• Check the permissions on that specific file or folder.
• Confirm the file name matches exactly what is linked in your website code.
• Verify the file is uploaded to the correct directory.

Error Affects the Entire Website

• Review your .htaccess file for global deny rules.
• Check whether your hosting account has been suspended due to billing or policy issues.
• Confirm your domain's DNS is pointing to the correct hosting server.

You Are Blocked from Your Own Site

• Visit a site such as whatismyip.com.au to find your current public IP address.
• Check your hosting control panel's IP Deny Manager or firewall settings for your IP address.
• Remove the block if found, or contact your hosting provider to whitelist your IP.

Still Having Issues?