What Is the 403 Forbidden Error & How to Fix It (8 Methods Explained)

Start A Free 7-day Email Course On WordPress

403 Forbidden – you don’t have permission to access this resource is an HTTP status code that occurs when the web server understands the request but can’t provide you additional access.

It can happen when you visit an empty website directory or a specific page that has a permission error.

However, if you or your visitors encounter this error on your site, it’s necessary to fix the issue or you may risk losing valuable traffic. Since its causes vary, there are many methods to resolve the 403 forbidden error.

Thus, we will explain the different types of 403 forbidden errors, their possible causes, and also provide eight methods to fix the 403 forbidden error.

403 Forbidden Error Codes

403 is an HTTP status code, which is a standard response code from the web server to the client’s browser. When there is an error, these codes communicate the cause of the problem so that users know why the page isn’t loading.

In the case of the 403 error code, the message has several variations on the client-side, and some don’t even contain the 403 code itself. Here are some examples of 403 error messages:

• Forbidden: You don’t have permission to access [directory] on this server
• HTTP Error 403 – Forbidden
• Error 403 – Forbidden
• 403 forbidden request forbidden by administrative rules
• 403 Forbidden
• Access Denied – You don’t have permission to access
• Error 403
• HTTP 403
• Forbidden

Causes of 403 Forbidden Error

Often, 403 forbidden errors are caused by an access misconfiguration on the client-side, which means you can usually resolve the issue yourself.

A common cause of these errors is the file or folder permission settings, which control who can read, write, and execute the file or folder.

There are two possibilities in this case: either the website owner edited the settings so that you couldn’t access the resources, or they didn’t set the correct permissions.

The second common cause is a corrupt or incorrect setting in the .htaccess file. This might happen after you’ve made changes in the file. Luckily, it’s easy to solve the issue by simply creating a new .htaccess file.

Other than those two common causes, here are some other possible triggers for the error:

• Missing index page – the website’s homepage name is not index.html or index.php.
• Faulty WordPress plugin – if a WordPress plugin is not configured correctly or is incompatible with another plugin, it may trigger the 403 error.
• Wrong IP address – the domain name points to a wrong or an old IP address which now hosts a website that blocks your access.
• Malware infection – a malware infection may cause the .htaccess file to be constantly corrupted. You’ll need to remove the malware before restoring the file.
• New web page link – the site owner may have updated the page’s link, which is now different from the cached version.

How to Fix the Error 403 Forbidden Message

Since the error 403 forbidden is closely related to file access permissions, it will be the main focus of the following methods to fix it. That said, there are other ways of resolving this issue, such as clearing the web browser cache or scanning for malware.

Let’s take a deeper look at each of the eight available methods to solve the HTTP error 403.

Please note that while the steps mentioned here mainly focus on WordPress, they can be applied to other websites as well.

1. Check .htaccess File

You may not be familiar with the .htaccess file, as it often remains hidden in the site directory. However, if you use Hostinger File Manager, the .htaccess file is available in your public_html directory by default. Follow these steps to locate it:

1. Find the File Manager on the hPanel dashboard.

2. Open the public_html directory to find the .htaccess file.

If you use cPanel, follow these steps:

1. Locate File Manager in the cPanel.

2. In the public_html directory, look for the .htaccess file.

3. If you can’t find the .htaccess file, click on Settings on the top-right corner of the screen and enable the Show Hidden Files (dotfiles) option.

The .htaccess file is a server configuration file and mainly works by altering the Apache Web Server settings.

Although the .htaccess is present in most websites by default, you need to create a .htaccess file manually if your website doesn’t have it or the file was deleted unintentionally.

Now that you have found the file, follow these steps to check whether a wrong file configuration is causing the error:

1. Right-click the .htaccess file and select Download to create a backup.

2. Once you have a backup, delete the file.

2. Try accessing your website. If it works fine, this indicates that the .htaccess file was corrupted.
3. To generate a fresh .htaccess file, log in to your WordPress dashboard and click on Settings -> Permalinks.
4. Without making any changes, click the Save Changes button at the bottom of the page.

This will generate a fresh .htaccess file for your website. If this didn’t solve the issue, try the next method.

2. Reset File and Directory Permissions

Another reason for encountering a 403 error forbidden message is incorrect permissions for files or folders. In general, when files are created, they come with specific default file permissions, which control how you can read, write, and execute them.

However, an FTP client also lets you edit file and folder permissions. To begin, you should:

1. Configure an FTP client and connect it to your website.
2. Once connected, right-click public_html and select File Attributes.

3. Enter permission 755 in the Numeric value field, select Apply to directories only, and press OK.

The general practice for file permission numeric values is using 755 for folders, 644 for static content, and 700 for dynamic content.

4. After changing folder permissions, repeat step 2 and step 3, but now enter 644 in the Numeric value field and select the Apply to files only option.

Once done, try accessing your website and see if the 403 forbidden error is solved.

3. Disable WordPress Plugins

If you have come this far, the chances are that the error was caused by an incompatible or faulty plugin. In this step, we will try disabling plugins to check whether doing so fixes the 403 forbidden error.

We recommend disabling all the plugins at once instead of going through the process individually. Following this method, you should be able to detect the problem and work towards a solution. Here is what you have to do:

1. Access your hosting account via FTP or use the hosting account’s file manager and go to the public_html -> wp-content folder.
2. Locate the plugins folder.

3. Rename the folder with a different name like “disabled-plugins” to disable all plugins.

Try reaccessing the website. If the 403 forbidden error is no longer there, a problematic plugin is the actual source of the error.

Rename the folder back to plugins. Now you have to disable the plugins one by one from your WordPress dashboard and check if the site is still working. This way, you will be able to detect the faulty plugin.

Once you find it, update the plugin if necessary or install a new one. However, if the error message still appears, you may need to contact your hosting provider for assistance.

4. Upload an Index Page

Check your website’s homepage name as it should be called index.html or index.php. If it’s not, then there are two alternatives. The first and simplest one is to rename the homepage as index.html or index.php.

However, if you want to keep the current homepage name, upload an index page to your public_html directory and create a redirect to your existing homepage. Here are the steps to follow:

1. Upload an index.html or index.php file to your public_html directory. Use your hosting account’s file manager or FTP to do so.
2. Open the .htaccess file.
3. Insert this code snippet to redirect the index.php or index.html file to your existing homepage. Don’t forget to replace homepage.html with the page’s actual name.

Redirect /index.html /homepage.html

5. Edit File Ownership

Incorrect file ownership can trigger the 403 forbidden error if you use Linux or VPS hosting. Typically, files and folders can be assigned to an Owner, a Group, or both.

Keep in mind that you need SSH access to modify file ownership in Linux and VPS hosting. You’ll also need an SSH terminal to connect to the VPS server.

Once you’ve connected SSH to your web server, check the file ownership by using this SSH command:

ls -1 [file name]

The result will look something like this:

-rwxrw-rw- 1 [owner][group] 20 Jul 20 12:00 filename.txt

Look at the owner and group part. The correct ownership should be your hosting account’s username. If you find different ownership, use the chown Linux command to modify file ownership. Here’s the basic syntax for chown:

chown [owner][:group] [file name]

For example, if your username is Hostinger, use the syntax like this:

chown Hostinger filename.txt

If you don’t feel comfortable using SSH yourself, contact our support team for help.

6. Verify the A Record

The 403 forbidden error can also happen if your domain name points to the wrong IP address, where you don’t have permission to view the content. Therefore, double-check that your domain name points to the correct IP address.

To check if the domain A record is pointed correctly, access the DNS Zone Editor on your hPanel:

1. Log in to your hPanel.
2. Go to the Advanced section and click on DNS Zone Editor.

3. You will see the list of DNS records. Find a record with the label A in the type column.

4. Check the IP address on the Content column.
5. If it’s pointing to the wrong IP address, click Edit to change it. Once you’ve finished, click Update.

If you don’t find the correct record, create a new one from the Manage DNS records section. Make sure you select A as the Type and insert the correct IP address into the Points to field. Then, click Add Record.

If you have recently migrated from one web host to another and forgot to change your nameservers, your domain may still be pointing to your old web host.

Once the old host cancels your account, it will cause a 403 error status code. Therefore, always make sure your domain is pointing to the right web host.

7. Scan for Website Malware

Malware can be another cause of the 403 error. If your WordPress site gets infected by malicious software, it may constantly keep injecting unwanted code into the .htaccess file. That way, even if you keep fixing the .htaccess file using the first method we presented, the error will persist.

Scan your website to identify any malware. There are plenty of security plugins for WordPress, such as Sucuri or Wordfence, to do so.

If you find malware on your website, there are two methods to solve this issue.

Most WordPress security plugins like WordFence can remove malware. Once the plugin identifies all infected files, you’ll get actionable options for these files, such as deleting or restoring them.

Another method is restoring the website using the backup files. It’s also possible to restore it using the database backup if you don’t have a complete backup of the site files.

8. Clear Your Web History/Cache

Your browser’s cache and cookies may also cause a 403 error. Cache stores data to make a website load faster the next time you visit it.

However, it’s possible that the website’s link has been updated, and the actual web page link is now different from the cached version.

Another possibility is that the error comes from the cookies. It may be the case on a website that you usually log in normally, but the latest login attempt showed you this error message.

Clearing browser cache and cookies should resolve this issue. Note that clearing the browser cache may cause the next visit to the website to take a long time as your browser will request all the site files again. Clearing the cookies also signs you out from all logged-in websites.

Follow these steps to do clear cache and cookies on Google Chrome:

1. Click on the three-dot icon on the top right corner and select Settings.
2. Find the Privacy and security section and click Clear browsing data.

3. Use the drop-down menu to select the time frame for data deletion. Then, check the Cookies and other site data and Cached images and files options.

4. Click Clear data.

Once you’ve completed all the steps, try revisiting the website and logging in if it requires you to do so.

If this or any other solutions don’t work, we recommend contacting our support team via live chat to resolve this issue.

Wrapping Up

A 403 forbidden error message can cause a great deal of frustration as it will prohibit you from accessing a website or a web page. It mainly occurs due to incorrect file permissions, but there are several other possible causes, like a missing index page, faulty plugin, or even malware infection.

Finding the real cause of the 403 error can be tricky. However, by following the methods listed in this article, we’re sure you can get your website working again.

To recap, here are the actions you can take to get rid of the 403 error message on your WordPress site:

1. Check the .htaccess file.
2. Reset file and directory permissions.
3. Disable WordPress plugins.
4. Upload an index page.
5. Edit file ownership.
6. Verify the A record.
7. Remove any malware.
8. Clear the web browser’s history and cache.

The 403 forbidden error is just one of many HTTP error codes. You may have encountered other client-side errors such as the 404 error or server-side errors like the 504 gateway timeout.

We encourage you to keep learning about these errors so that you know how to handle them if they ever appear on your website.