8 Ways to Fix the 403 Forbidden Error in WordPress

The 403 Forbidden error in WordPress appears when the server understands your request but refuses to authorize it. Unlike a 404 (page not found) or a 500 (internal server error), a 403 indicates a permissions or access control issue. The most common cause is a corrupted .htaccess file or incorrect file permissions, and the quickest fix is to reset the .htaccess file via the WordPress admin dashboard.

• Key Takeaways
• Resetting .htaccess is the fastest fix for most 403 errors.
• Check file and folder permissions (755 for directories, 644 for files).
• Deactivate plugins and themes via FTP to isolate conflicts.
• Security plugins like Wordfence can block your own IP — check their rules.
• If nothing works, contact your hosting provider to check server-level blocks.

What Causes the 403 Forbidden Error in WordPress?

Before diving into fixes, it helps to understand common triggers. The 403 error is almost always a server-side permission problem, not a missing page or a script crash.

• Corrupted .htaccess file
• Incorrect file or folder permissions
• Plugin or theme conflict that blocks access
• Security plugin rules (e.g., Wordfence, iThemes Security) that blacklist your IP
• Server-level modsecurity rules
• Wrong WordPress URL settings
• CDN or caching plugin misconfiguration
• Hosting provider firewall or hotlink protection

Before You Start: Back Up Your Site and Database

Always create a full backup — files and database — before making changes. A small misstep in file permissions or .htaccess can take your entire site offline. Use your hosting control panel or a plugin like UpdraftPlus to export a backup.

1. Is Your .htaccess File Corrupted? Reset It.

The .htaccess file is the most common culprit. A corrupted rule or a leftover redirect can trigger a 403. Resetting it takes 30 seconds.

Steps:

1. Log in to your WordPress admin dashboard.
2. Go to Settings → Permalinks.
3. Click Save Changes — no need to change any option. WordPress regenerates the .htaccess file automatically.
4. If you cannot access the admin area, use FTP or cPanel File Manager to rename .htaccess to .htaccessold in your site's root folder. Then visit your site — if it loads, the error is gone. Create a new .htaccess by saving permalinks once you regain access.

# Example .htaccess generated by WordPress
BEGIN WordPress
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
END WordPress

2. Are Your File Permissions Set Correctly?

Incorrect file permissions can block WordPress from reading files. The standard setup is 755 for directories and 644 for files. The wp-config.php file should be 600 or 640.

How to check via FTP:

1. Connect to your server using an FTP client (e.g., FileZilla).
2. Navigate to your WordPress root directory.
3. Right-click the wp-content folder, select File Permissions, set it to 755, and check Recurse into subdirectories (apply to directories only).
4. Repeat for a file (e.g., index.php) — set to 644 and apply to files only.

If you're unsure, many hosting panels offer a "Reset file permissions" tool. Use it if available.

3. Could a Plugin or Theme Be Blocking Access?

A newly installed plugin or theme — especially security or caching plugins — can accidentally block your IP or the entire admin area.

Disable all plugins via FTP:

1. Go to /wp-content/plugins/ via FTP.
2. Rename the entire plugins folder to pluginsold.
3. Check your site. If the 403 disappears, a plugin is the culprit.
4. Rename the folder back to plugins, then rename individual plugin folders one by one to identify the offender.

For themes, rename the active theme folder inside /wp-content/themes/ (e.g., twentytwentyfour to twentytwentyfourold). WordPress will fall back to a default theme.

4. Is a Security Plugin Blocking Your IP?

Popular security plugins like Wordfence or iThemes Security maintain IP blocklists. If you triggered a rule (e.g., too many login attempts), your own IP can get blocked.

Fix via FTP:

1. Rename the security plugin's folder in /wp-content/plugins/ to deactivate it.
2. Alternatively, access your database via phpMyAdmin and delete the plugin's option rows (e.g., wordfenceblockedIPs).
3. Once you regain access, whitelist your IP in the plugin's settings.

5. Are Your WordPress URL Settings Wrong?

If the WordPress Address (URL) and Site Address (URL) in Settings → General point to different domains (e.g., one with www and one without), WordPress may redirect to a forbidden URL.

Fix via wp-config.php: Add these lines before the / That's all, stop editing! / line:

define('WPHOME', 'https://yourdomain.com');
define('WPSITEURL', 'https://yourdomain.com');

Replace https://yourdomain.com with your actual site URL. Save the file and reload your site.

6. Is modsecurity or a Server Firewall Blocking You?

modsecurity is a web application firewall that can trigger false positives and block legitimate requests. Your hosting provider must disable it for your account.

What to do:

• Check your hosting control panel for a "modsecurity" toggle (often under "Security" or "Web Application Firewall").
• If not available, open a support ticket and ask them to disable modsecurity for your domain temporarily to test.
• Alternatively, you can try adding this rule to your .htaccess to bypass modsecurity for WordPress admin:

<IfModule mod_security.c>
SecFilterEngine Off
SecFilterScanPOST Off
</IfModule>

Place it at the top of your .htaccess file. If it works, the error is caused by modsecurity.

7. Is Your CDN or Caching Plugin Causing the 403?

Content delivery networks (CDNs) like Cloudflare or caching plugins like WP Rocket sometimes cache a 403 response or block requests from certain IP ranges.

Troubleshoot:

• If you use Cloudflare, try Pausing it from the Cloudflare dashboard and reload your site.
• For caching plugins, rename the plugin folder via FTP to deactivate it.
• Clear your browser cache and any server-side cache (e.g., via your hosting panel).

8. Could It Be a Hosting-Level Block?

Some hosting providers implement hotlink protection, IP deny lists, or .htaccess overrides that you cannot see. If none of the above fixes work, contact support with clear details.

What to tell support:

• "I'm getting a 403 Forbidden error on my WordPress site at [URL]. I've already reset .htaccess, checked file permissions, and deactivated plugins. Can you check if any server-level firewall or modsecurity rule is blocking my IP?"

Most hosts can resolve this in minutes once they know the context.

How to Prevent the 403 Forbidden Error in the Future

Prevention is simpler than recovery. Stick to these habits:

• Always test plugins and themes on a staging site before going live.
• Keep backups — automatic daily backups let you restore within minutes.
• Monitor file permissions after any server migration or update.
• Whitelist your IP in security plugins before making bulk changes.
• Use a reliable hosting provider that offers responsive support.

Once your site is healthy again, focus on growing it. nativeWP helps you publish SEO-optimized content on autopilot — connect your own OpenRouter API key and bulk-generate articles directly into WordPress. Learn more about nativeWP.

Frequently Asked Questions