403 Forbidden: Why the Server Refuses and How to Fix It
403 Forbidden is the server saying it understood your request and will not fulfil it. Signing in again usually changes nothing, because the refusal comes from a rule: file permissions, a folder with no index page, a firewall or security plugin, or a storage bucket that is private. Find the rule and you have the fix.
| Cause | Typical setting | Fix |
|---|---|---|
| File or folder permissions | Files 600 or folders 700 owned by another user | Files 644, folders 755, owned by the web server user |
| Folder with no index page | Directory listing switched off | Add index.html or index.php |
| Firewall or WAF rule | Cloudflare WAF, Wordfence, ModSecurity | Check the security event log for the block |
| Deny rule in config | .htaccess Deny or Nginx deny | Remove or narrow the rule |
| Private storage bucket | Amazon S3 without read access | Grant read through a bucket policy or CloudFront |
Updated
A 403 is a deliberate refusal, which makes it easier to fix than most errors: something on the server decided this request is not allowed. The answer to which rule fired is almost always written in a log, whether that is the web server's error log, a security plugin's history or your CDN's firewall events.
Reset web permissions safely
Standard permissions for a site folder
Replace /var/www/site and www-data with your site path and the web server's user.
sudo chown -R www-data:www-data /var/www/site
sudo find /var/www/site -type d -exec chmod 755 {} \;
sudo find /var/www/site -type f -exec chmod 644 {} \;Fixes by server and platform
Apache: Options -Indexes turns a folder without index.html into a 403, and a leftover 'Require all denied' or 'Deny from all' in .htaccess blocks everything below it. Check the Apache error log for 'client denied by server configuration'.
Nginx: look for 'directory index of ... is forbidden' (no index file) or 'Permission denied' (the worker user cannot read the path). Every parent folder needs execute permission for the worker, not only the file.
Static hosting on Amazon S3: the bucket blocks public access by default. Serve it through CloudFront with origin access control, or add a bucket policy that grants read on the objects you mean to publish.
When the 403 is a security tool doing its job
Firewalls block patterns that look like attacks, and an ordinary form post can match by accident, for example code in a comment field. Rather than switching the firewall off, find the rule ID in the event log and add a narrow exception for that path.
On a site hosted by We.Inc there is no web server, PHP process or function timeout of your own to tune. If a page on a We.Inc site returns this code, send support the address and the time so we can check our side.
How it works
- Check whether the 403 affects every visitor or only you, for example from another network.
- Look at the error page's branding to see which layer refused: CDN, host or app.
- Read that layer's log for the request and the rule or permission it cites.
- Change that one rule or permission and test again before changing anything else.
Tips
- Never fix a permissions 403 with chmod 777. It lets any process on the server change your files.
- If only you get a 403, your IP may be on a block list after too many failed logins. Try mobile data to confirm.
- A 403 on an upload folder can be intentional: many hosts block PHP from running in wp-content/uploads.
- Amazon S3 returns 403 rather than 404 for a missing file when the caller lacks list permission, so a 403 there can mean a wrong file name.
Frequently asked questions
What does 403 Forbidden mean?
The server received and understood the request but refuses to give access. Unlike 401, logging in is not expected to help, because the refusal is not about missing credentials.
What is the difference between 401 and 403?
401 Unauthorized means the request has no valid credentials and the server asks for them. 403 Forbidden means credentials, if any, do not grant access to this resource.
How do I fix 403 Forbidden on WordPress?
Check file permissions (644 for files, 755 for folders), regenerate .htaccess by saving Settings, Permalinks, then disable security plugins one at a time to see if one is blocking you. Your host's error log names the cause.
Why does Nginx return 403 for my folder?
Nginx found no index file for the folder and directory listing is off by default, or the Nginx worker cannot read the files. Add an index file, or fix ownership so the worker user can read the path.
Can a 403 come from Cloudflare?
Yes. A Cloudflare-branded 403 or block page means a WAF rule, bot setting or IP access rule stopped the request before it reached your server. Security, Events in the Cloudflare dashboard shows which rule.
Related: 401 vs 403, 404 Not Found, Nginx errors, HTTP status codes.
Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.
More in Guides
- 404 Not Found: Why Pages Go Missing and How to Fix It
- 404 Page Examples: 20 Designs With Copy-Paste Code
- 409 Conflict: When a Request Clashes With Current State
- 500 Internal Server Error: Finding the Real Cause
- 502 Bad Gateway: Meaning and Fixes
- 503 Service Unavailable: Meaning, Causes and Fixes
- 504 Gateway Timeout: What Timed Out and How to Fix It
- Abandoned Cart Email Examples and Templates
Product
Who It's For
- For Agencies
- For Freelancers
- For Hosting Providers
- For SaaS Platforms
- For Startups
- For Financial Services
- For Healthcare
Features
Resources
- Blog
- Help Center
- Free Business Tools
- Free UI Components
- Website Templates
- Template Collections
- Website Examples
- Guides
- Comparisons
- Alternatives
- Best Lists
- Reviews
- Pricing Guides
- Use Cases
- Glossary & Guides
- Integrations
- Developers
- Benchmark
- Windows App