How to Fix 403 Forbidden Error in cPanel

Seeing a 403 Forbidden error on your website can be frustrating, especially when your website was working perfectly before. This error means that your web server understands the request but refuses to allow access to the requested page or file.

Fortunately, in most cases, the issue can be be resolved within a few minutes using cPanel.

This guide walks you through the most common causes and the steps to fix them.

What Does a 403 Forbidden Error Mean?

A 403 Forbidden error indicates that the web server is preventing visitors from accessing a page or resource.

Unlike a 404 Not Found error, the requested file usually exists. However, the server is blocking access because of permissions, security rules, or server configuration.

Common error messages include:

• 403 Forbidden
• Access Denied
• Forbidden
• You don’t have permission to access this resource.
• HTTP Error 403

What Causes a 403 Forbidden Error?

Several issues can trigger this error, including:

• Incorrect file permissions
• Incorrect folder permissions
• Corrupted .htaccess file
• Missing index file
• IP address restrictions
• Hotlink protection
• Security plugins
• ModSecurity firewall rules
• Incorrect ownership of website files
• Disabled directory listing

Solution 1: Check File Permissions

Incorrect permissions are the most common cause.

Typical permission values are:

To check permissions:

1. Log in to cPanel.
2. Open File Manager.
3. Navigate to your website’s root directory (usually public_html).
4. Right-click a file or folder.
5. Select Permissions.
6. Verify they match the recommended values.

Avoid setting permissions to 777, as this creates security risks and may still trigger server protections.

Solution 2: Check Folder Permissions

If a folder cannot be accessed, verify that every parent directory also has the correct permissions.

Recommended folder permission:

755

Incorrect permissions on just one directory can block access to the entire website.

Solution 3: Rename the .htaccess File

A corrupted .htaccess file is another common cause.

To test this:

1. Open File Manager.
2. Go to public_html.
3. Locate .htaccess.
4. Rename it to:

.htaccess_old

Now visit your website.

If the website loads correctly, generate a new .htaccess file.

For WordPress:

• Log in to the WordPress dashboard.
• Go to Settings → Permalinks.
• Click Save Changes.

WordPress automatically creates a fresh .htaccess file.

Solution 4: Make Sure an Index File Exists

Most web servers expect one of the following files:

index.php
index.html
index.htm

If none exist, visitors may receive a 403 Forbidden error instead of your website.

Check that your website has a valid homepage inside public_html.

Solution 5: Disable IP Blocking

If your own IP address is blocked, you’ll receive a 403 error while others may still access the website.

Check:

• IP Blocker in cPanel
• Firewall settings
• Cloudflare Firewall Rules
• Security plugins

Remove your IP if it appears on the blocked list.

Solution 6: Review Hotlink Protection

Hotlink protection may accidentally block legitimate image or file requests.

Inside cPanel:

Security → Hotlink Protection

Temporarily disable it and test your website again.

Solution 7: Check ModSecurity

Many hosting providers enable ModSecurity, which blocks suspicious requests automatically.

Sometimes legitimate traffic is mistakenly blocked.

Inside cPanel:

Security → ModSecurity

If available:

• Disable ModSecurity temporarily.
• Test the website.
• Re-enable it after troubleshooting.

If you cannot manage ModSecurity yourself, contact your hosting provider.

Solution 8: Verify File Ownership

If website files were uploaded using SSH or migrated from another server, ownership may be incorrect.

This is common after:

• Website migrations
• Restoring backups
• Manual uploads
• VPS migrations

Incorrect ownership usually requires your hosting provider to correct it.

Solution 9: Disable Security Plugins

WordPress security plugins can accidentally block visitors.

Common examples include:

• Wordfence
• iThemes Security
• All In One WP Security

Temporarily disable the plugin and check if the error disappears.

Solution 10: Clear Your Browser Cache

Sometimes browsers cache the error page.

Try:

• Clearing your browser cache
• Opening the website in Incognito mode
• Testing from another device
• Testing from another internet connection

Solution 11: Check Cloudflare Firewall Rules

If you’re using Cloudflare, review:

• Firewall Rules
• WAF Rules
• Browser Integrity Check
• Country Blocking
• Rate Limiting

Temporarily disable custom firewall rules to identify whether Cloudflare is causing the issue.

Solution 12: Contact Your Hosting Provider

If none of the above solutions resolve the issue, your hosting provider can review:

• Server error logs
• Apache or LiteSpeed logs
• ModSecurity logs
• Account permissions
• Server firewall rules

These logs usually identify the exact cause of the 403 error.

Frequently Asked Questions

Is a 403 Forbidden error caused by DNS?

No. DNS issues typically result in errors such as DNS_PROBE_FINISHED_NXDOMAIN or Server IP Address Could Not Be Found, not a 403 Forbidden error.

Can SSL cause a 403 Forbidden error?

Not usually. SSL problems typically generate certificate warnings or HTTPS errors rather than a 403 response.

Can WordPress plugins cause a 403 error?

Yes. Security, firewall, redirect, or caching plugins can occasionally block legitimate requests.

Does changing file permissions fix every 403 error?

No. While incorrect permissions are one of the most common causes, server firewall rules, .htaccess issues, IP blocking, or ModSecurity can also trigger the error.