WordPress 403 Forbidden Error: 7 Fixes That Actually Work (2026)

A 403 means the server understood you and said no. Not a crash, not a timeout - a refusal. Something is actively blocking the request: permissions, an .htaccess rule, a security plugin, a firewall, or an IP block. Five things cause nearly every WordPress 403, and the server error log tells you which one before you change a single file.

Before Touching Anything: Cheap Checks

1. 1.Read the error log. cPanel > Metrics > Errors, or error_log in site root. "Permission denied" = permissions. "Client denied by server configuration" = .htaccess/mod_security. This single log line saves an hour of guessing.
2. 2.Test incognito + another device + VPN off. A cached 403, a browser extension, or an IP block at your VPN's exit node can all fake the error. Loads elsewhere = IP-based block, not a site problem.
3. 3.403 on a folder URL only? Like /uploads/. That is normal - directory listing is off and there's no index file. The server is protecting your file list. Visit a real page.

1. The wp-admin-Only Pattern: Security Rules First

403 on the whole site = permissions or .htaccess. 403 only on wp-admin/wp-login = a security rule, almost every time. Check in order:

• -Security plugin blocklist: Wordfence/iThemes/Sucuri may have flagged your IP (failed logins, rate limits). Whitelist your IP from the plugin settings or via the plugin's mu-plugin removal.
• -WAF/mod_security: your host's web application firewall flagged a request pattern. Check the log, ask support to whitelist the rule.
• -Hotlink protection gone rogue: a CDN or cPanel hotlink rule can 403 legitimate requests - temporarily disable and test.

2. Fix File and Folder Permissions

The classic cause. WordPress needs: 755 on directories, 644 on files, 440 on wp-config.php. A plugin install, migration, or malware scan can silently flip them. Via FTP (FileZilla):

1. 1.Right-click the site root > File Attributes > numeric 755 > "Recurse into subdirectories" > "Apply to directories only"
2. 2.Again, numeric 644 > recurse > "Apply to files only"
3. 3.wp-config.php individually > 440 (it's your database credentials - never world-readable)

Never chmod 777. It doesn't fix a 403 caused by wrong ownership - it just makes every file writable by every process on the server. If ownership is wrong, that's a chown for your hosting user, which shared hosts must run for you.

3. Regenerate .htaccess

Apache reads .htaccess on every request - one bad line 403s the whole site. Rename .htaccess to .htaccess_old via FTP and reload. Site back? A rule in the old file was the block (common: Require all denied, a stale IP deny list, hotlink rules). Regenerate clean via wp-admin > Settings > Permalinks > Save Changes. Nginx has no .htaccess - check location blocks in the site config instead.

4. Deactivate Plugins

Security, firewall, and some caching plugins can 403 on their own. Can't reach wp-admin? Rename wp-content/plugins to plugins_off via FTP. Site loads = a plugin did it. Rename back, reactivate one by one. Start suspicion with whatever plugin manages logins, firewalls, or IP rules.

5. Check the Index File

Every served directory needs an index file. If index.php was deleted, renamed, or an index.html is shadowing it, Apache may refuse the directory. Confirm index.php exists in site root with correct spelling and 644 permissions, and that DirectoryIndex index.php is set (default .htaccess handles this).

6. CDN and DNS

Cloudflare WAF rules can 403 specific countries, IPs, or request patterns - pause Cloudflare (or set Development Mode) and test. Wrong DNS records can point you at an old server where you have no permissions at all - verify the site resolves to the correct IP after any migration.

7. Malware Scan

Malware sometimes chmods files to lock them or injects deny rules into .htaccess. If the 403 came with other weirdness (new admin users, redirects for visitors only, pharma spam), scan before restoring permissions - otherwise you fix the symptom while the infection re-breaks it. Clean first, then permissions, then .htaccess.

Related: ERR_TOO_MANY_REDIRECTS fix - 500 internal server error - hacked site recovery - WordPress security hardening.