How to Fix the 403 Forbidden Error in WordPress

If you’re encountering a 403 Forbidden error on your WordPress site, don’t panic — it’s one of the most common issues WordPress users face, and it’s usually easy to fix. This guide will walk you through why it happens, how to diagnose the source, and the exact steps you can take to resolve it.

What Is the 403 Forbidden Error?

The 403 Forbidden error is an HTTP status code that means your server understands the request — but refuses to authorize it. This happens when the server permissions are set in a way that prevents access to a specific resource or path.

Typical error messages include:

  • 403 Forbidden - You don’t have permission to access / on this server.
  • You are not authorized to view this page.
  • Access Denied.

Common Causes of the 403 Error in WordPress

  • Incorrect File or Directory Permissions
  • Corrupted or Misconfigured .htaccess File
  • Security Plugin Blocking Access
  • WordPress Firewall Configuration Issues
  • Mod_Security Rules on the Server
  • Invalid or Expired Login Sessions

Method 1: Fix Incorrect File Permissions

 

Incorrect file or directory permissions are one of the most frequent culprits.

Recommended permission settings:

  • Files: 644
  • Directories: 755

To fix:

# Connect via SSH or FTP
# Navigate to your WordPress root directory
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;

If you’re using an FTP client like FileZilla, right-click the root folder > File Permissions > and apply the correct permissions recursively.

Method 2: Replace the .htaccess File

Restore Your WordPress Files

A corrupt .htaccess file can trigger 403 errors. You can safely regenerate it.

Steps:

  1. Connect via FTP or SSH.
  2. Rename .htaccess to .htaccess-backup
  3. Log into your WordPress dashboard > Settings > Permalinks > Save Changes

This will create a fresh .htaccess file with default rules.

Method 3: Deactivate Security Plugins

Temporarily Disable the WordPress Firewall

Security plugins like Wordfence, Sucuri, or iThemes Security may unintentionally block access.

To test:

  • Connect via SFTP and rename the /wp-content/plugins/wordfence directory to /wordfence-old
  • Refresh your site

If this resolves the issue, access the plugin settings after renaming the folder back, and adjust the firewall or rules.

Method 4: Temporarily Disable the Web Application Firewall (WAF)

Your server may be running ModSecurity or a custom WAF that incorrectly blocks legitimate requests.

Solution:

Contact your hosting provider and request to:

  • Whitelist your IP address
  • Review ModSecurity logs
  • Temporarily disable the WAF for debugging purposes

Pressillion customers can request this via live chat or by opening a support ticket.

Method 5: Restore Core WordPress Files

Missing or modified core files may also trigger access issues.

To restore:

  1. Download a fresh copy of WordPress from wordpress.org
  2. Extract it locally
  3. Upload only the /wp-admin and /wp-includes folders to your server (do not overwrite wp-content)
  4. Overwrite existing files

Bonus Tip: Clear Browser Cache and Cookies

Sometimes the error persists due to outdated browser sessions. Clear your cookies and refresh the page using Ctrl + F5.

FAQs About the 403 Forbidden Error

Q: Can I fix the 403 error without technical knowledge?
A: Yes, most fixes like resetting .htaccess or deactivating plugins can be done via your hosting control panel or an FTP client.

Q: Will changing permissions break my site?
A: If done correctly (755 for directories, 644 for files), it won’t. Avoid 777 permissions — they are insecure.

Q: Could malware cause a 403 error?
A: Yes. Some malware alters file permissions or .htaccess. Run a scan with a security plugin like Wordfence or Sucuri.

Q: What if I’m using Pressillion and this happens?
A: Our team can resolve 403 issues quickly. Contact support, and we’ll check logs, permissions, and .htaccess for you.

Recap

To fix a 403 Forbidden error in WordPress, follow these steps:

  • ✅ Check file and folder permissions
  • ✅ Replace the .htaccess file
  • ✅ Deactivate or reconfigure security plugins
  • ✅ Contact your host about WAF rules or ModSecurity
  • ✅ Restore WordPress core files if needed

Resolving 403 errors restores your site’s accessibility and eliminates disruptions to user experience or SEO.

Sources