Key takeaways
- A 403 Forbidden error means the server understood the request but refuses access.
- Common causes: security plugin or firewall rules, a broken .htaccess file, wrong file permissions, or a missing index file.
- Work through the checks in order, and make sure Googlebot isn’t being blocked by mistake.
A 403 can appear on the whole site, only on /wp-admin, when saving a post, or only for some visitors. The pattern tells you where to look. Here’s the troubleshooting order I use.
Step 1: identify where the 403 happens#
| Where | Likely cause |
|---|---|
| Whole site | .htaccess rules, permissions, missing index.php, hosting suspension |
| Only wp-admin or wp-login | Security plugin, login protection, IP block, host firewall |
| When saving posts or uploading | ModSecurity / WAF rule triggered by content |
| Only for some countries or networks | Firewall geo-blocking or rate limiting (Cloudflare, Wordfence) |
| Specific files (images, PDFs) | Hotlink protection or file permissions |
Step 2: security plugins and firewalls#
- Temporarily deactivate security plugins by renaming their folder in
wp-content/plugins. - Check Wordfence/Solid Security “blocked IPs” and allowlist your own IP.
- In Cloudflare, check Security → Events for blocked requests and the rule responsible.
- Ask your host whether ModSecurity blocked the request — they can see the rule ID and whitelist it.
Step 3: regenerate .htaccess#
- Download
.htaccessfrom the site root as a backup, then delete or rename it. - If the site loads, the file was the problem.
- In WordPress, go to Settings → Permalinks and click Save — WordPress writes a fresh default file:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPressThen re-add custom rules (redirects, security headers) one at a time.
Need a hand with this?
Get a quick, honest review of your website’s SEO.
Step 4: file permissions and ownership#
- Folders: 755. Files: 644.
wp-config.php: 600 or 640. - Files must be owned by the correct hosting user — ask your host to fix ownership after migrations.
- Make sure
index.phpexists in the root and directory listing isn’t the only option.
Step 5: plugins and CDN#
- Deactivate all plugins (rename the plugins folder) to test for conflicts.
- Pause the CDN or proxy temporarily to see whether it’s the source.
- Check hotlink protection settings if only images return 403.
Don’t block Googlebot#
Aggressive firewalls and “bad bot” rules sometimes block search engines. Use Search Console’s URL Inspection to test a live URL — if it reports “Blocked due to access forbidden (403)”, allowlist verified Googlebot. Persistent 403s will drop pages from the index. See HTTP status codes.
403 error FAQ#
Is 403 the same as 401?#
No. 401 means authentication is required; 403 means access is refused even if you’re authenticated.
Can a 403 hurt rankings?#
Yes, if Googlebot keeps getting 403 for important pages, they can be dropped from the index.
Why do I get 403 when saving a post?#
Often a server firewall (ModSecurity) flags code or certain words in your content. Your host can whitelist the rule.