RegisterLogin
WordPress Troubleshooting

How to Fix the 403 Forbidden Error in WordPress

Learn the exact technical steps to troubleshoot and resolve the 403 Forbidden Error in WordPress by fixing file permissions, .htaccess corruption, and security plugins.

Nextgen Support•
How to Fix the 403 Forbidden Error in WordPress

Encountering a 403 Forbidden Error on your WordPress site can be incredibly frustrating. Unlike a 404 error (where the page simply doesn’t exist) or a 500 error (where the server crashes), a 403 error means the server is working perfectly fine, but it is actively refusing to let you view the requested page.

In plain English, the server is saying: “I know exactly what you are asking to see, but you do not have the proper authorization to look at it.”

In this technical guide, we will break down the three primary causes of the 403 Forbidden error in WordPress and show you exactly how to fix them.

What Causes the 403 Forbidden Error?

A 403 Forbidden error in a WordPress environment is almost always triggered by one of the following three security or configuration issues:

  1. Strict Security Plugins/Firewalls: A plugin has flagged your IP address or your specific request as malicious and is blocking you.
  2. Corrupted .htaccess File: A malformed rewrite or deny rule in your server configuration is blocking legitimate traffic.
  3. Incorrect File Permissions: The operating system permissions on your WordPress files and directories are configured too restrictively, preventing the web server (Apache/Nginx) from reading them.

Step 1: Deactivate Security Plugins

WordPress security plugins like Wordfence, iThemes Security, or Sucuri are fantastic tools, but they can sometimes be overzealous. If a plugin’s Web Application Firewall (WAF) misinterprets a legitimate action—such as updating a post with custom HTML or logging in from a new IP—it will immediately throw a 403 Forbidden error to protect the site.

How to fix it: If you can still access your wp-admin dashboard, simply deactivate all security plugins. If the error disappears, reactivate them one by one to find the culprit, and then adjust its firewall settings or whitelist your IP.

If you are completely locked out of the site:

  1. Access your site via FTP or your host’s File Manager.
  2. Navigate to wp-content/plugins/.
  3. Rename your security plugin’s folder (e.g., rename wordfence to wordfence_old).
  4. Reload your site. If it works, the plugin was blocking you.

Step 2: Fix a Corrupted .htaccess File

The .htaccess file controls how Apache handles URLs and directory access. Many plugins write rules to this file automatically. If a plugin inserts a rule like Deny from all in the wrong place, your entire site will return a 403 error.

How to fix it:

  1. Open your File Manager or FTP client.
  2. Go to the root folder of your WordPress installation (where wp-config.php is located).
  3. Find the .htaccess file. (Note: Make sure “Show Hidden Files” is enabled, as files starting with a dot are hidden by default).
  4. Rename it to .htaccess_backup.

Try reloading your website. If it works, you have solved the problem!

To generate a fresh, uncorrupted .htaccess file, log into your WordPress dashboard, navigate to Settings > Permalinks, and simply click the Save Changes button at the bottom of the page without altering any settings.

Step 3: Correct Your File Permissions

If neither plugins nor the .htaccess file was the issue, your server’s file permissions are likely messed up.

In a Linux server environment, every file and folder has a numeric permission code that tells the operating system who is allowed to Read, Write, or Execute it. If the permissions are set to restrict the web server user (usually www-data or nobody) from reading the files, Apache will throw a 403 Forbidden error.

The Correct WordPress Permissions:

  • All Directories (Folders) should be 755 or 750.
  • All Files should be 644 or 640.
  • The wp-config.php file can safely be 440 or 400 for added security.

How to fix it: You can manually change these permissions using your FTP client (like FileZilla) by right-clicking folders, selecting “File permissions”, and typing 755, making sure to select “Recurse into subdirectories” and “Apply to directories only.” Then repeat the process for files using 644.

Alternatively, if you have SSH access to your VPS Server, you can fix permissions instantly with these two commands from your WordPress root directory:

find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;

[!TIP] Messing with file permissions can be daunting. If you are hosted on our optimized WordPress Hosting, our technical support team can run a one-click permission fix on your account instantly. Just open a support ticket!

Proper directory permissions and automated .htaccess configurations come standard on reliable shared cPanel hosting.