The page returns “403 Forbidden”, “Access Denied”, or “You don't have permission to access this resource”. Sometimes only the admin area is affected; sometimes it is one folder, or the whole domain.
What it actually means
A 403 is not confusion. The server found the thing you asked for, understood the request perfectly, and declined to hand it over. Somebody, somewhere, set a rule saying you are not allowed — and the server is enforcing it faithfully.
The trick is that the rule is rarely one you remember setting. Security plugins, firewalls, file permissions, and .htaccess directives all issue 403s, often on your behalf and without much explanation.
What usually causes it
Most likely first.
- 1
A security plugin or firewall blocking you
Failed logins, an unfamiliar IP address, or a VPN can get your own address blocklisted by the tool you installed to protect the site.
- 2
Wrong file or folder permissions
Folders should generally be 755 and files 644. After a migration or restore, permissions frequently land wrong and the server refuses to serve.
- 3
An .htaccess rule denying access
A deny directive, a hotlink protection rule, or a corrupted rewrite block will produce a clean 403 across whatever it covers.
- 4
A missing index file
Requesting a directory with no index file and no directory listing allowed returns 403 rather than 404. Common after a botched deploy.
- 5
Host-level or CDN security rules
Managed hosts and CDNs run their own rule sets, and a legitimate request that resembles an attack pattern gets refused before it ever reaches your code.
How to fix it
Work through these in order. Take a backup before you change anything.
Step 1 — Work out the scope
Is it one URL, one folder, the admin area, or everything? A 403 on wp-admin alone points at security tooling; a site-wide 403 points at permissions or .htaccess.
Step 2 — Check whether your IP is blocked
Load the site on cell data with wifi off. If it works there, your address is on a blocklist — in a security plugin, at the host, or in the CDN.
Step 3 — Rename .htaccess and retest
Rename it to .htaccess-old. If the 403 clears, the rule was inside — regenerate a clean file rather than hunting through the broken one.
Step 4 — Reset permissions
Set directories to 755 and files to 644, and confirm ownership matches the web user. Do not use 777 to make an error go away; it creates a security problem in place of a permissions one.
Step 5 — Disable security plugins over SFTP
If you are locked out of the admin, rename the plugin's folder to disable it, regain access, then allowlist your address properly before switching it back on.
When to stop and call someone
Call someone if you are locked out of your own admin with no SFTP access, if the 403 appeared alongside other unexplained changes, or if resetting permissions puts it right for an hour and then it returns — recurring 403s sometimes indicate something else rewriting your files.
Frequently asked
It means the server found the page and understood the request, but a rule says you are not permitted to see it. Unlike a 404, the resource exists — access to it is being deliberately refused by permissions, a firewall, or a configuration rule.
Most often a security plugin or host firewall has blocklisted your IP address, frequently after failed login attempts or a change of network. Loading the site on cell data confirms it: if the admin works there, your address is blocked rather than your account.
As a rule, directories set to 755 and files set to 644, owned by the web server user. Setting anything to 777 will usually clear a 403, but it makes the file world-writable and trades a permissions problem for a security hole.
Yes, and it is a common cause. A deny rule, hotlink protection, or a corrupted rewrite block will return a clean 403 for everything it covers. Renaming the file and reloading is the fastest way to confirm it in under a minute.
Usually it is security working, not failing — a firewall or permission rule doing its job, occasionally too enthusiastically. It becomes a concern when it appears with other unexplained changes, or returns repeatedly after being fixed, which can indicate something rewriting your files.
If you’d rather not
We do this work every week. These are the services that cover it.
- Fixing Broken WebsitesSite down, hacked, or falling apart? We diagnose it fast, fix what's broken, and tell you straight how to keep it from happening again.
- Malware Removal & SecurityA hacked site costs you customers and Google's trust at the same time. We remove the malware, close the hole that let it in, and harden what is left.
- Fixing WordPress PluginsOne bad plugin can take your whole site down. We fix plugin conflicts, fatal errors, and security holes fast — and build custom plugins when the off-the-shelf ones fall short.
See exactly what’s holding your website back.
Get a free audit of your site — speed, SEO, mobile, and security — with the fixes that matter most, delivered as a PDF to your inbox.