{"id":3628,"date":"2026-07-16T21:57:02","date_gmt":"2026-07-16T21:57:02","guid":{"rendered":"https:\/\/veerhost.com\/docs\/cpanel\/how-to-fix-403-forbidden-error-in-cpanel\/"},"modified":"2026-07-16T21:59:46","modified_gmt":"2026-07-16T21:59:46","slug":"how-to-fix-403-forbidden-error-in-cpanel","status":"publish","type":"docs","link":"https:\/\/veerhost.com\/de\/docs\/cpanel\/how-to-fix-403-forbidden-error-in-cpanel\/","title":{"rendered":"How to Fix 403 Forbidden Error in cPanel"},"content":{"rendered":"<p class=\"wp-block-paragraph\">Seeing a <strong>403 Forbidden<\/strong> error on your website can be frustrating, especially when your website was working perfectly before. This error means that your web server understands the request but refuses to allow access to the requested page or file.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Fortunately, in most cases, the issue can be be resolved within a few minutes using cPanel.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This guide walks you through the most common causes and the steps to fix them.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What Does a 403 Forbidden Error Mean?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A <strong>403 Forbidden<\/strong> error indicates that the web server is preventing visitors from accessing a page or resource.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Unlike a <strong>404 Not Found<\/strong> error, the requested file usually exists. However, the server is blocking access because of permissions, security rules, or server configuration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Common error messages include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>403 Forbidden<\/li>\n\n\n\n<li>Access Denied<\/li>\n\n\n\n<li>Forbidden<\/li>\n\n\n\n<li>You don&#8217;t have permission to access this resource.<\/li>\n\n\n\n<li>HTTP Error 403<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What Causes a 403 Forbidden Error?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Several issues can trigger this error, including:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Incorrect file permissions<\/li>\n\n\n\n<li>Incorrect folder permissions<\/li>\n\n\n\n<li>Corrupted <code>.htaccess<\/code> file<\/li>\n\n\n\n<li>Missing index file<\/li>\n\n\n\n<li>IP address restrictions<\/li>\n\n\n\n<li>Hotlink protection<\/li>\n\n\n\n<li>Security plugins<\/li>\n\n\n\n<li>ModSecurity firewall rules<\/li>\n\n\n\n<li>Incorrect ownership of website files<\/li>\n\n\n\n<li>Disabled directory listing<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Solution 1: Check File Permissions<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Incorrect permissions are the most common cause.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Typical permission values are:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>File Type<\/th><th>Permission<\/th><\/tr><\/thead><tbody><tr><td>Files<\/td><td>644<\/td><\/tr><tr><td>Folders<\/td><td>755<\/td><\/tr><tr><td>Executable Scripts<\/td><td>755<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">To check permissions:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Log in to cPanel.<\/li>\n\n\n\n<li>Open <strong>File Manager<\/strong>.<\/li>\n\n\n\n<li>Navigate to your website&#8217;s root directory (usually <code>public_html<\/code>).<\/li>\n\n\n\n<li>Right-click a file or folder.<\/li>\n\n\n\n<li>Select <strong>Permissions<\/strong>.<\/li>\n\n\n\n<li>Verify they match the recommended values.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Avoid setting permissions to <strong>777<\/strong>, as this creates security risks and may still trigger server protections.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Solution 2: Check Folder Permissions<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If a folder cannot be accessed, verify that every parent directory also has the correct permissions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Recommended folder permission:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>755<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Incorrect permissions on just one directory can block access to the entire website.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Solution 3: Rename the .htaccess File<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A corrupted <code>.htaccess<\/code> file is another common cause.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To test this:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open <strong>File Manager<\/strong>.<\/li>\n\n\n\n<li>Go to <code>public_html<\/code>.<\/li>\n\n\n\n<li>Locate <code>.htaccess<\/code>.<\/li>\n\n\n\n<li>Rename it to:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>.htaccess_old<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Now visit your website.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the website loads correctly, generate a new <code>.htaccess<\/code> file.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For WordPress:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Log in to the WordPress dashboard.<\/li>\n\n\n\n<li>Go to <strong>Settings \u2192 Permalinks<\/strong>.<\/li>\n\n\n\n<li>Click <strong>Save Changes<\/strong>.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress automatically creates a fresh <code>.htaccess<\/code> file.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Solution 4: Make Sure an Index File Exists<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Most web servers expect one of the following files:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>index.php\nindex.html\nindex.htm<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If none exist, visitors may receive a <strong>403 Forbidden<\/strong> error instead of your website.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Check that your website has a valid homepage inside <code>public_html<\/code>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Solution 5: Disable IP Blocking<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If your own IP address is blocked, you&#8217;ll receive a 403 error while others may still access the website.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Check:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>IP Blocker in cPanel<\/li>\n\n\n\n<li>Firewall settings<\/li>\n\n\n\n<li>Cloudflare Firewall Rules<\/li>\n\n\n\n<li>Security plugins<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Remove your IP if it appears on the blocked list.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Solution 6: Review Hotlink Protection<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Hotlink protection may accidentally block legitimate image or file requests.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Inside cPanel:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Security \u2192 Hotlink Protection<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Temporarily disable it and test your website again.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Solution 7: Check ModSecurity<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Many hosting providers enable <strong>ModSecurity<\/strong>, which blocks suspicious requests automatically.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sometimes legitimate traffic is mistakenly blocked.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Inside cPanel:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Security \u2192 ModSecurity<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If available:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Disable ModSecurity temporarily.<\/li>\n\n\n\n<li>Test the website.<\/li>\n\n\n\n<li>Re-enable it after troubleshooting.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If you cannot manage ModSecurity yourself, contact your hosting provider.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Solution 8: Verify File Ownership<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If website files were uploaded using SSH or migrated from another server, ownership may be incorrect.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is common after:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Website migrations<\/li>\n\n\n\n<li>Restoring backups<\/li>\n\n\n\n<li>Manual uploads<\/li>\n\n\n\n<li>VPS migrations<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Incorrect ownership usually requires your hosting provider to correct it.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Solution 9: Disable Security Plugins<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress security plugins can accidentally block visitors.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Common examples include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Wordfence<\/li>\n\n\n\n<li>iThemes Security<\/li>\n\n\n\n<li>All In One WP Security<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Temporarily disable the plugin and check if the error disappears.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Solution 10: Clear Your Browser Cache<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Sometimes browsers cache the error page.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Try:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Clearing your browser cache<\/li>\n\n\n\n<li>Opening the website in Incognito mode<\/li>\n\n\n\n<li>Testing from another device<\/li>\n\n\n\n<li>Testing from another internet connection<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Solution 11: Check Cloudflare Firewall Rules<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you&#8217;re using Cloudflare, review:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Firewall Rules<\/li>\n\n\n\n<li>WAF Rules<\/li>\n\n\n\n<li>Browser Integrity Check<\/li>\n\n\n\n<li>Country Blocking<\/li>\n\n\n\n<li>Rate Limiting<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Temporarily disable custom firewall rules to identify whether Cloudflare is causing the issue.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Solution 12: Contact Your Hosting Provider<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If none of the above solutions resolve the issue, your hosting provider can review:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Server error logs<\/li>\n\n\n\n<li>Apache or LiteSpeed logs<\/li>\n\n\n\n<li>ModSecurity logs<\/li>\n\n\n\n<li>Account permissions<\/li>\n\n\n\n<li>Server firewall rules<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These logs usually identify the exact cause of the 403 error.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Frequently Asked Questions<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">Is a 403 Forbidden error caused by DNS?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. DNS issues typically result in errors such as <strong>DNS_PROBE_FINISHED_NXDOMAIN<\/strong> or <strong>Server IP Address Could Not Be Found<\/strong>, not a 403 Forbidden error.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Can SSL cause a 403 Forbidden error?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Not usually. SSL problems typically generate certificate warnings or HTTPS errors rather than a 403 response.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Can WordPress plugins cause a 403 error?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. Security, firewall, redirect, or caching plugins can occasionally block legitimate requests.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Does changing file permissions fix every 403 error?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. While incorrect permissions are one of the most common causes, server firewall rules, <code>.htaccess<\/code> issues, IP blocking, or ModSecurity can also trigger the error.<\/p>","protected":false},"excerpt":{"rendered":"<p>Seeing a 403 Forbidden error on your website can be frustrating, especially when your website was working perfectly before. This error means [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":3167,"menu_order":9,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-3628","docs","type-docs","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/veerhost.com\/de\/wp-json\/wp\/v2\/docs\/3628","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/veerhost.com\/de\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/veerhost.com\/de\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/veerhost.com\/de\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/veerhost.com\/de\/wp-json\/wp\/v2\/comments?post=3628"}],"version-history":[{"count":1,"href":"https:\/\/veerhost.com\/de\/wp-json\/wp\/v2\/docs\/3628\/revisions"}],"predecessor-version":[{"id":3630,"href":"https:\/\/veerhost.com\/de\/wp-json\/wp\/v2\/docs\/3628\/revisions\/3630"}],"up":[{"embeddable":true,"href":"https:\/\/veerhost.com\/de\/wp-json\/wp\/v2\/docs\/3167"}],"wp:attachment":[{"href":"https:\/\/veerhost.com\/de\/wp-json\/wp\/v2\/media?parent=3628"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/veerhost.com\/de\/wp-json\/wp\/v2\/doc_tag?post=3628"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}