The WordPress 403 forbidden error means the server understood your request, confirmed who is making it, and decided you do not have permission to access what you asked for. Unlike a 404, which means the resource does not exist, the WordPress 403 forbidden error means it does exist — the server is just refusing to show it to you. This makes it particularly confusing for site owners who are being refused access to their own site, their own admin panel, or a resource they know should be there. In my experience, the WordPress 403 forbidden error has a handful of well-defined causes that each produce the error in a specific context: file permission problems that prevent the web server from reading files, .htaccess rules that block specific requests, security plugins or server-side firewalls that flag a request as suspicious, IP blocking, and in some cases, a missing index file that causes the server to refuse directory listing. Identifying which of these is responsible determines the fix, and this guide covers each one. For the bigger picture, our WordPress Errors Complete Guide pulls everything together.
What the WordPress 403 Forbidden Error Is Actually Telling You
The HTTP 403 status code is the server’s way of saying “access denied.” Where the WordPress 403 forbidden error appears — the front end, the admin panel, a specific URL, or only certain file types — gives you the first diagnostic clue about which cause is responsible. A WordPress 403 forbidden error that appears only on the admin login page points to a different cause than one that appears on every URL. A WordPress 403 forbidden error that appears only when accessing the uploads directory points somewhere different again.
The WordPress 403 forbidden error on the site’s homepage or every URL simultaneously almost always indicates a file permission problem or a .htaccess rule that is catching all requests. The web server cannot read the index file, or a rule is blocking all access. This is the most urgent form of the error because it takes the entire site offline for all visitors. A WordPress 403 forbidden error limited to /wp-admin/ often indicates that a security plugin or a manually added IP restriction is blocking admin access specifically — the front end works fine, but the backend is protected in a way that is now blocking you. A WordPress 403 forbidden error on individual files or the uploads directory is usually a file permission problem on that specific directory rather than a sitewide configuration issue.
The server error log is the fastest path to confirmation. Access it through cPanel → Errors or via FTP at public_html/error_log. A WordPress 403 forbidden error caused by a file permission problem will show “Permission denied” in the log. One caused by an .htaccess rule will typically reference the rule type or the .htaccess file itself. One caused by a security plugin or server-level WAF will often show the request being denied with a rule code or description. This log entry — matched with where the WordPress 403 forbidden error appears on the site — identifies the specific fix needed without guesswork.
Fix File Permissions Causing the WordPress 403 Forbidden Error
File and directory permissions that prevent the web server from reading WordPress files are one of the most common causes of the WordPress 403 forbidden error. When the web server user cannot read the index file in a directory — because permissions are set too restrictively — it returns a 403 rather than serving the file. This is different from a 404, where the file does not exist; the file is present but the server is denied read access by the operating system’s permission settings.
Correct WordPress permissions for preventing the WordPress 403 forbidden error are: all files at 644 (owner can read and write; group and others can only read), all directories at 755 (owner can read, write, and execute; group and others can read and execute). A directory permission of 700 — where only the owner can access the directory — causes the WordPress 403 forbidden error for the web server user if the web server runs as a different user than the file owner, which is the case on many shared hosting configurations.
To check and correct permissions, connect to your server via FTP. In FileZilla, the permissions column shows the numeric value for each item. Right-click any file or directory to change its permissions. For a full reset of a WordPress installation’s permissions, the most efficient approach is via SSH if available:
find /path/to/wordpress -type f -exec chmod 644 {} ;
find /path/to/wordpress -type d -exec chmod 755 {} ;
After correcting permissions, reload the page showing the WordPress 403 forbidden error. If the error clears, permissions were the cause. Pay particular attention to the wp-content/uploads/ directory, which requires 755 to allow WordPress to write new media files, and the WordPress root directory itself — a root directory with 700 permissions blocks the web server from accessing any file within it and produces the WordPress 403 forbidden error across the entire installation.
Fix .htaccess Rules Causing the WordPress 403 Forbidden Error
The .htaccess file is the second most common source of the WordPress 403 forbidden error. WordPress uses .htaccess for permalink URL rewriting, but security plugins, manual additions, and some hosting configurations add deny rules, IP restrictions, and access control directives that can block legitimate requests and produce the WordPress 403 forbidden error. A deny rule that catches too broadly, a mistakenly added Deny from all directive, or a conflicting rule from a plugin that was deactivated but whose .htaccess entries were not cleaned up can all result in the WordPress 403 forbidden error.
The quickest test is to rename .htaccess to .htaccess_backup via FTP, which removes all custom rules and forces WordPress to operate without the file. If the WordPress 403 forbidden error disappears, the problem was in .htaccess. WordPress will operate without the file, but permalink URLs will break until a new one is generated — go to Settings → Permalinks → Save Changes to generate a clean file. Then compare the original .htaccess_backup against the freshly generated file to identify which rules were present in the original that are absent in the clean version. Those rules are candidates for the WordPress 403 forbidden error cause — add them back one at a time, reloading after each addition, until the WordPress 403 forbidden error reappears.
Hardcoded IP restrictions are a specific .htaccess cause worth checking separately. A line like Order deny,allow / Deny from all / Allow from 1.2.3.4 restricts access to a single IP address. If your IP has changed since that rule was written — because you are on a dynamic IP, because you are working from a different location, or because a developer added the restriction and left — the WordPress 403 forbidden error appears for your current IP while the old allowed IP (if it still exists) continues to have access. Remove or update the IP restriction to restore access.
Security Plugins and Firewall Blocks Behind the WordPress 403 Forbidden Error
Security plugins that include request filtering, login protection, or web application firewall features are a significant source of the WordPress 403 forbidden error — both for site owners accidentally locking themselves out and for legitimate visitors being flagged as threats. Wordfence, iThemes Security, Sucuri Security, and All In One WP Security all include components that can produce the WordPress 403 forbidden error under specific conditions.
The most common security plugin scenario for the WordPress 403 forbidden error is an IP lockout after multiple failed login attempts. These plugins count failed login attempts and block the originating IP after a configurable threshold. If you have been locked out after failed logins, your IP is in the plugin’s block list and every request from your IP produces the WordPress 403 forbidden error at the login page and sometimes elsewhere. The temporary fix is to access the site from a different IP (mobile network rather than home broadband), log in, and whitelist your regular IP in the plugin’s settings. The permanent fix is configuring the lockout to use longer delay periods rather than hard IP blocks, or whitelisting your home and office IP ranges in advance.
Server-level web application firewalls — including those provided by Cloudflare, Sucuri’s DNS-level firewall, and some hosting providers’ built-in security tools — produce the WordPress 403 forbidden error that bypasses WordPress entirely. In these cases, deactivating WordPress plugins makes no difference because the block happens before the request reaches WordPress. The Cloudflare Firewall Events log, Sucuri’s dashboard, or your hosting provider’s security logs show the rule that triggered the WordPress 403 forbidden error and allow you to adjust the rule’s sensitivity or whitelist specific traffic patterns.
Index File Absence and Hotlink Protection Causing the WordPress 403 Forbidden Error
The WordPress 403 forbidden error on a specific directory URL — such as yoursite.com/wp-content/uploads/2024/ — is usually caused by the web server refusing to list directory contents when no index file is present. Most web servers are configured to return a 403 rather than show directory contents when accessed directly, as a security measure. This form of the WordPress 403 forbidden error is expected and intentional — you do not want visitors browsing your uploads directory — but it can appear unexpectedly when a link in a plugin or theme points to a directory URL rather than a file URL. The fix in this case is correcting the broken link to point to a specific file rather than a directory.
Hotlink protection rules — configured in cPanel or added to .htaccess — are another cause of the WordPress 403 forbidden error that is easy to overlook. Hotlink protection prevents other websites from embedding images or files from your server in their own pages, saving your bandwidth. When configured too aggressively, hotlink protection can block your own CDN, your own theme’s stylesheet loading, or image requests from your own domain, producing the WordPress 403 forbidden error for resources that should be freely accessible. Check your cPanel Hotlink Protection settings and verify that your own domain and any CDN domains you use are in the allowed list.
Our guide on fixing the WordPress login redirect loop covers admin access problems that often appear alongside the WordPress 403 forbidden error when security configuration issues affect the login flow. Our guide on how to secure a WordPress website covers security plugin configuration including the IP whitelist and lockout settings that prevent the self-lockout scenario that accounts for many WordPress 403 forbidden error reports. The Apache .htaccess documentation covers access control directives in detail — the authoritative reference for understanding the Require, Allow, and Deny syntax that most commonly produces the WordPress 403 forbidden error when misconfigured. See also How to Fix WordPress 403 Forbidden Error Safely With Effective Steps for a related case.
