A 403 Forbidden — shown on some servers as «No Permission to Access» — does not mean the page is missing. It means the server understood the request and refused to answer. The difference matters: a 404 says «I cannot find it»; a 403 says «I found it, and I am not letting you through».
There are almost always four causes, and you can tell them apart by what happened just before.
| Cause |
How to recognise it |
| Wrong permissions |
It started right after uploading files over FTP, unzipping them, or changing permissions. |
| No index file |
Only one folder returns 403 and the rest of the site works. Typical of new folders. |
| .htaccess is blocking |
It started after installing a security plugin, pasting rules copied off the internet, or an update. |
| Your IP got blocked |
The site opens on mobile data and not at the office. It is almost certainly this. |
Permissions: the numbers that matter
Every file and folder carries three permissions — read, write and execute — for three audiences: the owner, the group, and everyone else. That is what the three digits say.
| What |
Which value |
| Files (.php, .html, images) |
644. Some servers prefer 640; both work. |
| Folders |
755, or 750. |
| wp-config.php and files holding passwords |
640 or 600. Nobody else needs to read them. |
| 777, on anything |
Never. Not even «just to test». |
|
Why 777 is not a shortcut. 777 means any process on the server can write there. That is how one infected site goes on to infect the rest of the files, and it is the first place an attacker drops something. Worse: some configurations refuse to serve files set to 777 — so the very 403 you are trying to fix may have come from that.
|
To fix everything in one go, open File Manager in cPanel. It takes two passes, because folders and files do not take the same number:
| 1 |
Go into public_html and select everything. Right-click → Permissions.
|
|
| 2 |
Set 755, tick Recurse into subdirectories and choose apply to directories only.
|
|
| 3 |
Repeat with 644 and apply to files only.
|
|
| 4 |
Reload the site. If this was it, it comes straight back.
|
|
The folder has no index file
When someone requests a folder instead of a page, the server looks for an index.php or index.html inside it. If there is none, the alternative would be to list the files — and that is switched off, rightly so. Hence the 403.
The usual mix-up: the site was uploaded inside a folder, such as public_html/site/. The index has to be in public_html, not one level down. Move the contents, or make that folder the domain root.
.htaccess is blocking it
The .htaccess file rules the server folder by folder, and one line is enough to shut everything. The usual suspects are Deny from all, Order Allow,Deny and Require all denied.
| 1 |
In File Manager, turn on Settings → Show Hidden Files — the name starts with a dot, so it is hidden.
|
|
| 2 |
Rename .htaccess to .htaccess-off. Rename it, do not delete it — that way there is always a way back.
|
|
| 3 |
Reload the site. If the 403 is gone, the culprit is in that file.
|
|
| 4 |
On WordPress, go to Settings → Permalinks and click Save without changing anything: it writes a clean .htaccess by itself.
|
|
If it is not WordPress, put the name back and remove one line at a time until you find the one blocking. This is what WordPress writes by default, should you need to type it out:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
|
If the site is WordPress and only the dashboard returns 403. It is often a security plugin. Rename the wp-content/plugins folder to plugins-off, test, then put the right name back — the plugins end up deactivated and you re-enable them one by one. See cannot get into the WordPress dashboard.
|
It was our security system
The server blocks requests that look like an attack, and now and then it catches someone who did nothing wrong. There is one very clear sign: the site opens on mobile data and not at the office. In that case it is not the site — it is your network address that ended up on the list.
It mostly happens after several failed login attempts, on shared public networks, or with a VPN whose address someone else misused.
| 1 |
Find your address: search for my IP on Google, from the network where the site will not open.
|
|
| 2 |
Open a ticket with the address, the rough time and the domain. With those three we go into the server log and unblock it.
|
|
|
If files appeared that you did not put there. Odd names in the site root, .php files inside image folders, modification dates in the small hours — then the 403 may be the least of it. Do not just fix permissions: talk to us and restore an earlier copy — see how to restore your data with JetBackup.
|
Before you touch anything
Keep a copy. Mass permission changes and rewriting .htaccess are among the operations that have ruined the most sites while someone was trying to repair them. If the error is a different number, start from the guide to website errors: 500, 403, 404 and 508 — each code points somewhere else.
|
Still getting a 403 after all this? Send us the domain and the time.
Open a ticket
|
Português
English
