A 403 means the server knows exactly what was asked for and has decided not to allow it. Logging in again won't help. The usual causes are file permissions on the server, a folder with no index page, or a security rule (a firewall, a security plugin or your hosting's protection) that thinks the visitor looks suspicious. If only some visitors get it, suspect a security rule. If everyone gets it, suspect permissions or configuration.
What's the problem
Visitors see "403 Forbidden", "Access denied" or "You don't have permission to access this resource". It may be the whole site, one folder, the admin area, or only certain visitors or countries.
Why it happens
- File or folder permissions on the server are too strict, often after files were uploaded or moved.
- No index file in a folder, and the server is set not to list folder contents.
- A firewall or security rule is blocking the visitor: by IP address, country, browser, or because the request looks like an attack.
- A security plugin (on WordPress, for example) has locked an area or banned an address.
- The hosting account has been restricted or suspended.
- Hotlink protection blocking images when they're loaded from another site.
How to fix it
- Work out who gets it. Everyone, or only some people? Try from another network or country if you can.
- If only some visitors: check your firewall and security rules for recent blocks, and any security plugin's blocked list.
- If everyone: check file permissions. On typical Linux hosting, folders are
755and files644. - Check the folder has an index file (
index.htmlorindex.php). - Check for a recent change to
.htaccessor server config that added a "deny" rule. - Ask your host if the account has been restricted.
What Preventionlabs checks
One click runs the full report on your domain. For this problem it shows whether your site loads, how fast, and where its redirects go; up to 50 pages from your sitemap, listing any that fail or are slow, plus broken links on them. With Cloudflare connected, it also shows which requests the firewall blocked, by Cloudflare's own rule names; recent deploys and account changes, with their times.
Run your free reportYour first report is free, no card needed. Then A$50 a month, up to 10 domains. Read-only: it never changes anything.
Sources
- MDN Web Docs: 403 Forbiddenreference
The HTTP 403 Forbidden client error response status code indicates that the server understood the request but refused to process it.
- MDN Web Docs: 403 Forbiddenreference
This status is similar to 401 , except that for 403 Forbidden responses, authenticating or re-authenticating makes no difference.