You open your WordPress site and boom: 403 Forbidden. Not a 404, not a 500. The server got your request, understood it, and still said no. That’s the key difference. It’s not a broken link. It’s a permissions problem or a security rule slamming the door in your face.
I’ve seen this error kill small business sites for days. The owner panics, calls the host, the host blames a plugin, and nobody fixes it. Let’s cut through that. Here’s what actually causes a 403 Forbidden error in WordPress and how to kill it fast.
First: Is It Really a 403, or Something Else?
Before you touch anything, check the exact HTTP status. A 403 Forbidden means the server refuses to authorize the request. A 401 means you’re not authenticated. A 404 means the file isn’t there. People mix them up constantly.
If you see «403 Forbidden – nginx» or «Apache Server at yourdomain.com Port 80», that’s your server. If you see a WordPress-themed message, it might be a plugin faking it. Open Chrome DevTools, go to Network, reload, and look at the status code. That single step saves hours.
Also, test from a different network. Sometimes your office IP got banned by a firewall and only you see the 403. Your visitors are fine. That changes everything about how you fix it.
File Permissions: The #1 Cause of 403 Forbidden in WordPress
This is where 70% of cases live. WordPress files need specific permissions. Folders should be 755. Files should be 644. The wp-config.php file should be 600 or 644 depending on your host.
If someone set everything to 777 thinking «more permissions = more access», you just opened a security hole and some hosts will auto-block you. Yes, 777 can literally trigger a 403 on hardened servers.
- Connect via SFTP (FileZilla works) or your host’s File Manager.
- Right-click your WordPress root folder → Permissions → set to 755, apply recursively.
- Then select all files → Permissions → 644, apply recursively.
- Don’t touch wp-config.php unless you know your host’s rule.
On some cPanel hosts, you can run a quick SSH command: find /home/user/public_html -type d -exec chmod 755 {} ; and find /home/user/public_html -type f -exec chmod 644 {} ;. If you don’t have SSH, ask support. They do this in two minutes.
The .htaccess File Is Probably Screaming at You
Your .htaccess file controls redirects, security rules, and permalinks. One bad line and the whole site returns 403. I’ve seen security plugins write rules that block entire user agents or IP ranges, then the site owner forgets.
Quick test: rename .htaccess to .htaccess.bak via FTP. Reload your site. If it works, the file was the problem. Don’t leave it renamed — your permalinks will break. Instead, regenerate it.
Go to WordPress admin → Settings → Permalinks → click Save Changes. WordPress rewrites a clean .htaccess. If you can’t access wp-admin because of the 403, delete the file, log in, and save permalinks again.
Watch for these in .htaccess: Deny from all, Require all denied, or IP blocks from Wordfence, iThemes Security, or a host-level rule. Those are the usual suspects.
Plugin and Theme Conflicts: The Silent Killer
Security plugins are the most common culprits. Wordfence, Sucuri, and All In One WP Security can lock you out if they misidentify your IP or a login attempt. It’s ironic: the plugin protecting you becomes the reason you see 403 Forbidden in WordPress.
To test, deactivate all plugins. If you can’t access wp-admin, rename the /wp-content/plugins/ folder via FTP. WordPress auto-deactivates everything. Then rename it back and activate plugins one by one.
Same with themes. Switch to Twenty Twenty-Four. If the error vanishes, your theme or a child theme has a broken function or a bad file permission.
Server-Level Rules and Firewalls (ModSecurity, Cloudflare, etc.)
Your host might have ModSecurity rules blocking a request that looks like an attack. A URL with certain query strings, a POST to xmlrpc.php, or a suspicious user agent can trigger a 403. This is especially common on shared hosting.
Check your host’s error logs. cPanel has «Errors» under Metrics. There you’ll see the exact rule that fired. Ask support to whitelist your IP or disable the specific rule for your domain.
If you use Cloudflare, check Security → Events. Cloudflare can block requests based on WAF rules, bot fight mode, or country blocks. A misconfigured firewall rule there produces a 403 that looks like it comes from your server but doesn’t.
Real case: A client’s site returned 403 only for mobile users. Turned out Cloudflare’s bot fight mode flagged their carrier’s IP range. Ten seconds to fix once we looked at the right dashboard.
Index Files and Directory Listing
If your WordPress root is missing an index.php, or if directory listing is disabled and there’s no index file, Apache returns 403. Check that index.php exists in your root. If it’s gone, re-upload it from a fresh WordPress download.
Also, some hosts disable directory listing by default. That’s fine — you just need an index file. Don’
