How to Fix 403 Forbidden Error (Access Denied)

By ErrorFix · Updated October 13, 2026 · 7 min read

What the 403 Forbidden error means

HTTP status 403 means "forbidden." Your browser reached the server fine, and the server understood exactly what you asked for — it simply decided not to let you have it. Unlike a 404, where the page does not exist, a 403 confirms the resource is there but access is denied. You will see messages like "403 Forbidden," "Access Denied," or "You don't have permission to access this resource."

The denial can come from many layers: the site's file permissions, a misconfigured .htaccess file, hotlink protection that mistakes you for an image thief, a security plugin that flagged your IP, or the site owner deliberately restricting a page to logged-in users or specific countries. Because visitors and site owners each control different layers, this guide covers both sides.

Common causes

• Incorrect file or folder permissions: web files should be 644 and folders 755 — anything stricter can make the server refuse to serve them.
• Bad .htaccess rules: a single mistyped deny rule or redirect loop in .htaccess can block the entire site.
• Hotlink protection misfires: anti-hotlinking rules sometimes block legitimate visitors, especially when a CDN or referrer is involved.
• IP blocking or geo-restriction: the site's firewall, security plugin, or host may have blocked your IP address or your country.
• Empty or missing index file: if a directory has no index file and directory listing is disabled, the server returns 403 instead of showing the folder contents.

How to fix the 403 Forbidden error — step by step

Start with the visitor steps (1, 2, 5). If you own the site, the owner steps (3, 4) are where most 403s get fixed.

1. Refresh the page and check the URL. Press Ctrl + R (or Cmd + R on a Mac) — a 403 can be a momentary glitch during a server update. Then look carefully at the address bar: a typo in a directory name, a stray character, or a link pointing at a folder instead of a file (for example, example.com/admin/ instead of example.com/admin/login) commonly produces a 403. Retype the address manually or reach the page through the site's own navigation links instead of a bookmark.
2. Clear cookies and try an incognito window. A corrupted login cookie can make the server treat you as unauthorized. Press Ctrl + Shift + Delete, set the range to All time, check Cookies and other site data, and click Clear data. Then open an incognito window (Ctrl + Shift + N) and try the page — incognito runs without your extensions and stored cookies, which rules out both at once. If the page loads for a logged-out visitor but not for you, the problem is your session, not the site.
3. Site owner: fix file and folder permissions. Log in to your hosting control panel and open File Manager (or connect via FTP). Select your site's files and set file permissions to 644 and folder permissions to 755 — right-click the item, choose Change Permissions, and enter the numbers. Permissions like 600 or 700 on public files are a classic 403 trigger. Do not set anything to 777; that is a security hole. After correcting permissions, hard-refresh the page (Ctrl + F5) to test.
4. Site owner: check .htaccess for bad rules. In File Manager, show hidden files and open the .htaccess file in your site's root (public_html). Look for "deny from" or "Require all denied" rules that might be blocking legitimate traffic, and for hotlink-protection blocks (RewriteCond rules referencing image extensions) that may be too aggressive. To test, rename .htaccess to .htaccess.bak and reload the site — if the 403 disappears, the file was the cause. Restore it and remove or fix the offending lines one at a time.
5. Wait, try another network, then contact the site owner. If the 403 persists, wait 15 to 30 minutes — you may have tripped a rate limiter or a temporary firewall block. Try your phone's mobile data: if the page loads there, your home IP is blocked. As a visitor, use the site's contact page to report the 403, including the exact URL and the time it happened. As an owner getting these reports, check your security plugin's block log and your host's firewall (for example, ModSecurity rules) and whitelist the affected IPs.

Did this fix it? Quick checklist

• The page loads without the 403 message
• It works in an incognito window and on another network
• File permissions are 644 for files and 755 for folders
• No bad deny rules remain in .htaccess

If you are a visitor and the 403 appears only when you are logged in, try logging out and back in — your account's permissions may have changed. If you are an owner and the 403 affects your whole WordPress admin area right after installing a security plugin, disable the plugin via FTP (rename its folder under wp-content/plugins) to regain access, then reconfigure its firewall rules more carefully.