What Is the 403 Forbidden Error & How to Fix It (8 Methods Explained)

You might encounter the 403 forbidden error when you visit an empty website directory or a specific page that has a permission error. This is because most websites are set up to disallow directory browsing to prevent attackers from accessing sensitive files.

However, if you or your visitors encounter this error on your site, it’s necessary to fix the issue or you may risk losing valuable traffic. Since its causes vary, there are many methods to resolve the 403 errors.

We will explain the different types of 403 forbidden errors, their possible causes, and also provide eight methods to fix the 403 forbidden error.

Error code	403 Forbidden Error
Error type	Client-side error
Error variations	Forbidden: You don’t have permission to access [directory] on this server HTTP Error 403 – Forbidden Error 403 – Forbidden 403 forbidden request forbidden by administrative rules 403 Forbidden Access Denied – You don’t have permission to access Error 403 HTTP 403 Forbidden
Error causes	Missing index page Broken WordPress plugin Wrong IP address Malware infection New web page link

Video Tutorial

Learn the most common causes and how to fix the 403 forbidden error.

Causes of 403 Forbidden

Often, HTTP 403 forbidden errors are caused by an access misconfiguration on the client-side, which means you can usually resolve the issue yourself.

A common cause of these errors is the file or folder permission settings, which control who can read, write, and execute the file or folder.

There are two possibilities in this case: either the website owner edited the settings so that you couldn’t access the resources, or they didn’t set the correct permissions.

The second common cause is corrupt or incorrect settings in the .htaccess file. This might happen after you’ve made changes to the file. Luckily, it’s easy to solve the issue by simply creating a new server configuration file.

Other than those two common causes, here are some other possible triggers for the error:

• Missing index page – the website’s homepage name is not index.html or index.php.
• Faulty WordPress plugin – if a WordPress plugin is not configured correctly or is incompatible with another plugin, it may trigger the 403 errors.
• Wrong IP address – the domain name points to a wrong or old IP address which now hosts a website that blocks your access.
• Malware infection – a malware infection may cause the .htaccess file to be constantly corrupted. You’ll need to remove the malware before restoring the file.
• New web page link – the site owner may have updated the page’s link, which is now different from the cached version.

How to Fix the 403 Forbidden Error

Since the HTTP 403 forbidden error is closely related to file access permissions, this will be the main focus of the following methods to solve it. That said, there are other ways of resolving this issue, such as clearing the browser cache or scanning for malware.

Let’s take a better look at each of the eight available methods to solve the HTTP error 403.

Please note that while the steps mentioned here mainly focus on WordPress, they can be applied to other websites as well.

1. Check the .htaccess File

You may not be familiar with the .htaccess file, as it often remains hidden in the site directory. However, if you use Hostinger File Manager, the file is available in your public_html directory by default. 

Follow these steps to locate it:

1. Find the File Manager on the hPanel dashboard.

2. Open the public_html directory to find the .htaccess file.

If you use cPanel, follow these steps:

1. Locate File Manager on cPanel.

2. In the public_html directory, look for the .htaccess file.

3. If you can’t find the file, click on Settings on the top-right corner of the screen and enable the Show Hidden Files (dotfiles) option.

The .htaccess file is a server configuration file and mainly works by altering the Apache Web Server settings.

Although the file is present on most websites by default, you need to create a new .htaccess file manually if your website doesn’t have it or if it was deleted unintentionally.

Now that you have found the file, follow these steps to check whether a wrong configuration is causing the error:

1. Right-click on the file and select Download to create a backup.

2. Once you have the backup, delete the file.

2. Try accessing your website. If it works fine, this indicates that the file was corrupted.
3. To generate a fresh .htaccess file, log in to your WordPress dashboard and click on Settings -> Permalinks.
4. Without making any changes, click the Save Changes button at the bottom of the page.

This will generate a fresh .htaccess file for your website. If this didn’t solve the issue, try the next method.

2. Reset File and Directory Permissions

Another possible cause triggering HTTP 403 errors is incorrect permissions for files or folders. In general, when files are created, they come with specific default file permissions, which control how you can read, write, and execute them.

.

Using FTP will let you edit file and folder permissions. To begin, you should:

1. Configure an FTP client and connect it to your website.
2. Once connected, right-click public_html and select File Attributes.

3. Enter permission 755 in the Numeric value field, select Apply to directories only, and press OK.

The general practice for file permission numeric values is using 755 for folders, 644 for static content, and 700 for dynamic content.

4. After changing folder permissions, repeat step 2 and step 3, but now enter 644 in the Numeric value field and select the Apply to files only option.

Once done, try accessing your website and see if the error is resolved.

3. Disable WordPress Plugins

If you have come this far and none of the previous methods work, chances are that the error is caused by an incompatible or faulty plugin. In this step, we will try disabling plugins to check whether doing so fixes the 403 forbidden error.

We recommend disabling all the plugins at once instead of going through the process one by one. Following this method, you should be able to detect the problem and work towards a solution. Here is what you’ll have to do:

1. Access your hosting account via FTP or use the hosting account’s file manager and go to the public_html -> wp-content folder.
2. Locate the plugins folder.

3. Rename the folder with a different name like “disabled-plugins” to disable all plugins.

Try reaccessing the website. If the error is no longer there, a problematic plugin is the actual source of the error.

Rename the folder back to plugins. Now you have to disable the plugins one by one from your WordPress dashboard and check if the site is still working. This way, you will be able to detect the faulty plugin.

Once you find it, update the plugin if necessary or delete it. However, if the error still appears, you may need to contact your hosting provider for assistance.

4. Upload an Index Page

Check your website’s homepage name – it should be called index.html or index.php. If it’s not, then there are two alternatives. The first and simplest one is to rename the homepage as index.html or index.php.

However, if you want to keep the current homepage name, upload an index page to your public_html directory and create a redirect to your existing homepage.

Here are the steps to follow:

1. Upload an index.html or index.php file to your public_html directory. Use your hosting account’s file manager or FTP to do so.
2. Open the .htaccess file.
3. Insert this code snippet to redirect the index.php or index.html file to your existing homepage. Don’t forget to replace homepage.html with the page’s actual name.

Redirect /index.html /homepage.html

5. Edit File Ownership

Incorrect file ownership can trigger the 403 forbidden error if you use Linux or VPS web hosting. 

Typically, files and folders can be assigned to an Owner, a Group, or both. Keep in mind that you need SSH access to modify ownership in these environments. You’ll also need an SSH terminal to connect to the VPS.

Once you’ve connected SSH to your website server, check the ownership by using this SSH command:

ls -1 [file name]

The result will look something like this:

-rwxrw-rw- 1 [owner][group] 20 Jul 20 12:00 filename.txt

Look at the owner and group part. The correct ownership should be your hosting account’s username. If you see different ownership, use the chown Linux command to modify file ownership. Here’s the basic syntax for chown:

chown [owner][:group] [file name]

For example, if your username is Hostinger, use syntax like this:

chown Hostinger filename.txt

If you don’t feel comfortable using SSH yourself, contact our support team for help.

6. Verify the A Record

The 403 forbidden error can also happen if your domain name points to the wrong IP address, where you don’t have a permission to view the content. Therefore, double-check that your domain name points to the correct IP address.

To check if the domain A record is pointed correctly, access the DNS Zone Editor on your hPanel:

1. Log in to your hPanel.
2. Go to the Advanced section and click on DNS Zone Editor.

3. You will see a list of DNS records. Find a record with the label A in the type column.

4. Check the IP address on the Content column.
5. If it’s pointing to the wrong IP address, click Edit to change it. Once you’ve finished, click Update.

If you don’t find the correct record, create a new one from the Manage DNS records section. Make sure you select A as the Type and insert the correct IP address into the Points to field. Then, click Add Record.

If you have recently migrated from one web host to another and forgot to change your nameservers, your domain may still be pointing to your old web host. Once the old host cancels your account, it will cause a 403 error status code.

7. Scan for Malware

Malware can be another cause of the 403 error. If your WordPress site becomes infected by malicious software, it may constantly keep injecting unwanted code into the .htaccess file. That way, even if you keep fixing the file using the first method we presented, the error will persist.

Scan your website to identify any malware. There are plenty of security plugins for WordPress such as Sucuri or Wordfence to do so.

Most WordPress security plugins like WordFence can remove malware. Once the plugin identifies all infected files, you’ll get actionable options for these files, such as deleting or restoring them.

Another method is restoring the website using backup files. It’s also possible to restore it using the database backup if you don’t have a complete backup of the site files.

8. Clear Your Web History/Cache

Your browser’s cache and cookies may also cause a 403 error. Cache stores data to make a website load faster the next time you visit it. However, it’s possible that the website’s link has been updated, and the actual web page link is now different from the cached version.

Another possibility is that the error comes from the cookies. It may be the case on a website that you usually log in normally, but the latest login attempt showed you this error message.

Clearing browser cache and cookies should resolve this issue. Note that clearing the cache may cause the next visit to the website to take a long time as your browser will ask for all the site files again. Clearing the cookies also signs you out from all logged-in websites.

Follow these steps to clear the cache and cookies on Google Chrome:

1. Click on the three-dot icon on the top right corner and select Settings.
2. Find the Privacy and security section and click Clear browsing data.

3. Use the drop-down menu to select the time frame for data deletion. Then, check the Cookies and other site data and Cached images and files options.

4. Click Clear data.

Once you’ve completed all the steps, try revisiting the website and logging in if it requires you to do so. If this or any other solutions don’t work, we recommend contacting our support team via live chat to resolve this issue.

Conclusion

403 forbidden errors can cause a great deal of frustration as they will prohibit you from accessing a resource. They mainly occur due to incorrect file permissions, but there are several other possible causes, like a missing index file, faulty plugins, or even a malware infection.

Finding the real cause of the 403 errors can be tricky. However, by following the methods listed in this article, we’re sure you can get your website working again.

To recap, here are the actions you should take to get rid of the 403 error message on your WordPress site:

1. Check the .htaccess file.
2. Reset file and directory permissions.
3. Disable WordPress plugins.
4. Upload an index page.
5. Edit file ownership.
6. Verify the A record.
7. Remove any malware.
8. Clear the web browser history and cache.

The 403 forbidden error is just one of many HTTP error codes. As a website owner, you may have encountered other client-side errors such as the 404 error or server-side errors like the 504 gateway timeout.

We encourage you to keep learning about these errors so that you know how to handle them if they ever appear on your website.

403 Forbidden Error FAQ