403 error means

From Wikipedia, the free encyclopedia

HTTP 403 is an HTTP status code meaning access to the requested resource is forbidden. The server understood the request, but will not fulfill it.

Specifications[edit]

HTTP 403 provides a distinct error case from HTTP 401; while HTTP 401 is returned when the client has not authenticated, and implies that a successful response may be returned following valid authentication, HTTP 403 is returned when the client is not permitted access to the resource despite providing authentication such as insufficient permissions of the authenticated account.^[a]

Error 403: «The server understood the request, but is refusing to authorize it.» (RFC 7231)^[1]

Error 401: «The request requires user authentication. The response MUST include a WWW-Authenticate header field (section 14.47) containing a challenge applicable to the requested resource. The client MAY repeat the request with a suitable Authorization header field (section 14.8). If the request already included Authorization credentials, then the 401 response indicates that authorization has been refused for those credentials.» (RFC 2616)^[2]

The Apache web server returns 403 Forbidden in response to requests for URL^[3] paths that corresponded to file system directories when directory listings have been disabled in the server and there is no Directory Index directive to specify an existing file to be returned to the browser. Some administrators configure the Mod proxy extension to Apache to block such requests and this will also return 403 Forbidden. Microsoft IIS responds in the same way when directory list
ings are denied in that server. In WebDAV, the 403 Forbidden response will be returned by the server if the client issued a PROPFIND request but did not also issue the required Depth header or issued a Depth header of infinity.^[3]

Substatus error codes for IIS[edit]

The following nonstandard codes are returned by Microsoft’s Internet Information Services, and are not officially recognized by IANA.

• 403.1 – Execute access forbidden
• 403.2 – Read access forbidden
• 403.3 – Write access forbidden
• 403.4 – SSL required
• 403.5 – SSL 128 required
• 403.6 – IP address rejected
• 403.7 – Client certificate required
• 403.8 – Site access denied
• 403.9 – Too many users
• 403.10 – Invalid configuration
• 403.11 – Password change
• 403.12 – Mapper denied access
• 403.13 – Client certificate revoked
• 403.14 – Directory listing denied
• 403.15 – Client Access Licenses exceeded
• 403.16 – Client certificate is untrusted or invalid
• 403.17 – Client certificate has expired or is not yet valid
• 403.18 – Cannot execute request from that application pool
• 403.19 – Cannot execute CGIs for the client in this application pool
• 403.20 – Passport logon failed
• 403.21 – Source access denied
• 403.22 – Infinite depth is denied
• 403.502 – Too many requests from the same client IP; Dynamic IP Restriction limit reached
• 403.503 – Rejected due to IP address restriction

See also[edit]

• List of HTTP status codes
• URL redirection

Notes[edit]

References[edit]

External links[edit]

• Apache Module mod_proxy – Forward
• Working with SELinux Contexts Labeling files
• Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content

Все мы, путешествуя по просторам интернета, натыкаемся на различные ошибки при загрузке сайтов. Одна из них, кстати, достаточно часто встречается – я говорю об ошибке сервера 403 Forbidden Error. Сегодня я рассмотрю причины ее возникновения и способы устранения со стороны владельца сайта и его пользователя.

Что означает ошибка 403 и почему она появляется

Ошибка сервера 403 Forbidden означает ограничение или отсутствие доступа к материалу на странице, которую вы пытаетесь загрузить. Причин ее появления может быть несколько, и вот некоторые из них:

• Формат индексного файла неверен.
• Некорректно выставленные права на папку/файл.
• Файлы были загружены в неправильную папку.

Исправление ошибки сервера 403 Forbidden

Чтобы исправить ошибку сервера 403 Forbidden, обязательно нужен доступ к панели управления вашего хостинга. Все описанные ниже шаги применимы к любой CMS, но примеры будут показаны на основе WordPress.

Проверка индексного файла

Сначала я проверю, правильно ли назван индексный файл. Все символы в его имени должны быть в нижнем регистре. Если хотя бы один символ набран заглавной буквой, возникнет ошибка 403 Forbidden. Но это больше относится к ОС Linux, которой небезразличен регистр.

Еще не стоит забывать, что индексный файл может быть нескольких форматов, в зависимости от конфигураций сайта: index.html, index.htm, или index.php. Кроме того, он должен храниться в папке public_html вашего сайта. Файл может затеряться в другой директории только в том случае, если вы переносили свой сайт.

Любое изменение в папке или файле фиксируется. Чтобы узнать, не стала ли ошибка итогом деятельности злоумышленников, просто проверьте графу «Дата изменения».

Настройка прав доступа

Ошибка 403 Forbidden появляется еще тогда, когда для папки, в которой расположен искомый файл, неправильно установлены права доступа. На все директории должны быть установлены права на владельца. Но есть другие две категории:

• группы пользователей, в числе которых есть и владелец;
• остальные, которые заходят на ваш сайт.

На директории можно устанавливать право на чтение, запись и исполнение.

Так, по умолчанию на все папки должно быть право исполнения для владельца. Изменить их можно через панель управления TimeWeb. Для начала я зайду в раздел «Файловый менеджер», перейду к нужной папке и выделю ее. Далее жму на пункт меню «Файл», «Права доступа».  

Откроется новое окно, где я могу отрегулировать права как для владельца, так и для всех остальных.

Отключение плагинов WordPress

Если даже после всех вышеперечисленных действий ошибка не исчезла, вполне допустимо, что влияние на работу сайта оказано со стороны некоторых плагинов WordPress. Быть может они повреждены или несовместимы с конфигурациями вашего сайта.

Для решения подобной проблемы необходимо просто отключить их. Но сначала надо найти папку с плагинами. Открываю папку своего сайта, перехожу в раздел «wp-content» и нахожу в нем директорию «plugins». Переименовываю папку – выделяю ее, жму на меню «Файл» и выбираю соответствующий пункт. Название можно дать вот такое: «plugins-disable». Данное действие отключит все установленные плагины.

Теперь нужно попробовать вновь загрузить страницу. Если проблема исчезла, значит, какой-то конкретный плагин отвечает за появление ошибки с кодом 403.

Но что делать, если у вас плагин не один, а какой из них влияет на работу сайта – неизвестно? Тогда можно вернуть все как было и провести подобные действия с папками для определенных плагинов. Таким образом, они будут отключаться по отдельности. И при этом каждый раз надо перезагружать страницу и смотреть, как работает сайт. Как только «виновник торжества» найден, следует переустановить его, удалить или найти альтернативу.

Как решить проблему, если вы – пользователь

Выше я рассмотрела способы устранения ошибки 403 Forbidden для владельцев сайта. Теперь же разберу методы исправления в случаях с пользователем.

• Сначала надо убедиться, что проблема заключается именно в вашем устройстве. Внимательно проверьте, правильно ли вы ввели URL сайта. Может, в нем есть лишние символы. Или, наоборот, какие-то символы отсутствуют.
• Попробуйте загрузить страницу с другого устройства. Если на нем все будет нормально, значит, проблема кроется именно в используемом вами девайсе. Если нет – надо перейти к последнему шагу.
• Еще хороший вариант – немного подождать и обновить страницу. Делается это либо кликом по иконке возле адресной строки браузера, либо нажатием на комбинацию Ctrl + F5. Можно и без Ctrl, на ваше усмотрение.
• Если ничего из вышеперечисленного не помогло, надо очистить кэш и cookies. Провести такую процедуру можно через настройки браузера. Для этого необходимо открыть историю просмотров, чтобы через нее перейти к инструменту очистки. Эту же утилиту часто можно найти в настройках, в разделе «Конфиденциальность и безопасность». В новом окне нужно отметить пункты с кэшем и cookies и нажать на кнопку для старта очистки.

• Ошибка 403 Forbidden возникает и тогда, когда пользователь пытается открыть страницу, для доступа к которой сначала надо осуществить вход в систему. Если у вас есть профиль, просто войдите в него и попробуйте вновь загрузить нужную страницу.
• Если вы заходите со смартфона, попробуйте отключить функцию экономии трафика в браузере. Она находится в настройках, в мобильном Google Chrome под нее отведен отдельный раздел. 
• Последний шаг – подождать. Когда ни один способ не помогает, значит, неполадки возникли именно на сайте. Возможно, его владелец уже ищет способы решения проблемы и приступает к их исполнению, но это может занять какое-то время. Пользователям остается только дождаться, когда все работы будут завершены.

Еще одна допустимая причина появления ошибки сервера 403 – доступ к сайту запрещен для определенного региона или страны, в которой вы находитесь. Бывает и такое, что сайт доступен для использования только в одной стране. Если вы используете VPN, попробуйте отключить его и перезагрузите страницу. Вдруг получится все исправить. 

Если ничего из вышеперечисленного не сработало, рекомендуется обратиться к владельцу сайта. Есть вероятность, что никто не знает о возникшей проблеме, и только ваше сообщение может изменить ситуацию. 

Did you just try to access your WordPress site only to be hit by some message telling you something is “Forbidden” or that you don’t have permission to access something on your site? If so, you’ve likely run into the 403 Forbidden error on WordPress.

Seeing an error on your WordPress site can be frustrating and deflating, which is why we’ve created this detailed guide to help you fix the 403 Forbidden Error on WordPress and get your site functioning again as quickly as possible.

Let’s get started without any further introduction because we’re sure you just want to fix your site!

Prefer the video version?

What is the 403 Forbidden Error?

The Internet Engineering Task Force (IETF) defines the error 403 Forbidden as:

The 403 (Forbidden) status code indicates that the server understood the request but refuses to authorize it. A server that wishes to make public why the request has been forbidden can describe that reason in the response payload (if any).

Like many other common WordPress errors, the 403 Forbidden error is an HTTP status code that a web server uses to communicate with your web browser.

Quick background on HTTP status codes – whenever you connect to a website with your browser, the web server responds with something called an HTTP header. Usually, this all happens behind the scenes because everything is working normally (that’s a 200 status code, in case you were wondering).

However, if something goes wrong, the server will respond back with a different numbered HTTP status code. While these numbers are frustrating to encounter, they’re actually quite important because they help you diagnose exactly what’s going wrong on your site.

The 403 Forbidden error means that your web server understands the request that the client (i.e. your browser) is making, but the server will not fulfill it.

In more human-friendly terms, it basically means that your server knows exactly what you want to do, it just won’t let you do it because you don’t have the proper permissions for some reason. It’s kind of like you’re trying to get into a private event, but your name got accidentally removed from the guestlist for some reason.

Other HTTP status codes mean different things. We’ve written guides on fixing issues with 404 not found errors, 500 internal server errors, 502 bad gateway errors, and 504 gateway timeout errors.

What Causes the 403 Forbidden Error on WordPress?

The two most likely causes of the 403 Forbidden Error on WordPress are:

1. Corrupt .htaccess file
2. Incorrect file permissions

It’s also possible that you’re seeing the error because of an issue with a plugin that you’re using at your site. In this article, we’ll show you how to troubleshoot all of these potential issues.

403 Forbidden Error Variations

Like many other HTTP status codes, there are a lot of different variations for how this error code presents itself.

Here are some common variations that you might come across:

• “Forbidden – You don’t have permission to access / on this server”
• “403 – Forbidden: Access is denied”
• “Error 403 – Forbidden”
• “403 – Forbidden Error – You are not allowed to access this address”
• “403 Forbidden – nginx”
• “HTTP Error 403 – Forbidden – You do not have permission to access the document or program you requested”
• “403 Forbidden – Access to this resource on the server is denied”
• “403. That’s an error. Your client does not have permission to get URL / from this server”
• “You are not authorized to view this page”
• “It appears you don’t have permission to access this page.”

If you’re on an Nginx server, it will look like this below. Basically, if you see any mention of “forbidden” or “not allowed to access”, you’re probably dealing with a 403 Forbidden error.

How to Fix 403 Forbidden Error on WordPress

To help you fix the 403 Forbidden Error on your WordPress site, we’ll cover five separate troubleshooting steps in detail:

• File permissions
• .htaccess file
• Plugin issues
• CDN issues
• Hotlink protection

1. Modify Your File Permissions

Each folder and file on your WordPress site’s server has its own unique file permissions that control who can:

• Read – see the data in the file/view the contents of a folder.
• Write – modify the file/add or delete files inside a folder
• Execute – run the file and/or execute it as a script/access a folder and perform functions and commands.

These permissions are indicated by a 3-digit number, with each digit indicating the level of permission for each of the 3 categories above.

Normally, these permissions just “work” for your WordPress site. However, if something gets messed up with the file permissions at your WordPress site, it can cause the 403 Forbidden error.

To view and modify your site’s file permissions, you’ll need to connect via FTP/SFTP. Here’s how to use SFTP if you’re hosting at Kinsta.

For the screenshots in the tutorial below, we’ll be using the free FileZilla FTP program. The basic principles will apply to any FTP program, though – you’ll just need to apply them to a different interface.

Once you’re connected to your server, you can view a file or folder’s permissions by right-clicking on it:

Of course, manually checking the permissions for each file or folder isn’t really an option. Instead, you can automatically apply file permissions to all the files or folders inside of a folder.

According to the WordPress Codex, the ideal file permissions for WordPress are:

• Files  – 644 or 640
• Directories – 755 or 750

One exception is that your wp-config.php file should be 440 or 400.

To set these permissions, right-click on the folder that contains your WordPress site (the folder name is public at Kinsta). Then, choose File Attributes:

Enter 755 or 750 in the Numeric value box. Then, choose Recurse into subdirectories and Apply to directories only:

Once you’ve applied the correct permissions for directories, you’ll repeat the process for files. Only this time:

• Enter 644 or 640 in the Numeric value box
• Choose Recurse into subdirectories
• Choose Apply to files only

To finish the process, you just need to manually adjust the permissions for your wp-config.php file to make them 440 or 400:

If file permissions issues were causing the 403 Forbidden Error, your site should now start working again.

2. Delete and Restore the .htaccess File

Kinsta uses the NGINX web server, so this potential issue doesn’t apply if you’re hosting your site at Kinsta because Kinsta sites do not have a .htaccess file.

However, if you’re hosting elsewhere and your host uses the Apache web server, one common cause of the 403 Forbidden error is a problem in your site’s .htaccess file.

The .htaccess file is a basic configuration file used by the Apache web server. You can use it to set up redirects, restrict access to all or some of your site, etc.

Because it’s so powerful, even if a little mistake can cause a big issue, like the 403 Forbidden error.

Rather than trying to troubleshoot the .htaccess file itself, a simpler solution is to just force WordPress to generate a new, clean .htaccess file.

To do that:

• Connect to your server via FTP
• Find the .htaccess file in your root folder
• Download a copy of the file to your computer (it’s always a good idea to have a backup just in case)
• Delete the .htaccess file from your server after you have a safe backup copy on your local computer

Now, you should be able to access your WordPress site if your .htaccess file was the issue.

To force WordPress to generate a new, clean .htaccess file:

• Go to Settings → Permalinks in your WordPress dashboard
• Click Save Changes at the bottom of the page (you do not need to make any changes – just click the button)

And that’s it – WordPress will now generate a new .htaccess file for you.

3. Deactivate and then Reactivate Your Plugins

If neither your site’s file permissions nor .htaccess file are the problems, the next place to look is your plugins. It could be a bug in a plugin or a compatibility issue between different plugins.

No matter what the issue is, the easiest way to find the problematic plugin is with a little trial and error. Specifically, you’ll need to deactivate all of your plugins and then reactivate them one by one until you find the culprit.

If you can still access your WordPress dashboard, you can perform this process from the normal Plugins area.

If you cannot access your WordPress dashboard, you’ll instead need to connect to your WordPress site’s server via FTP/SFTP (here’s how to connect via SFTP at Kinsta).

Once you’re connected to your server via FTP:

1. Browse to the wp-content folder
2. Find the plugins folder inside of the wp-content folder
3. Right-click on the plugins folder and choose Rename
4. Change the name of the folder. You can name it anything different, but we recommend something like plugins-disabled to make it easy to remember.

By renaming the folder, you’ve effectively disabled all the plugins at your site.

Now, try accessing your site again. If your site is working, you know that one of your plugins is causing the 403 Forbidden error.

To find the culprit, reactivate your plugins one-by-one until you find which plugin is causing the issue.

After changing the file name of the plugins folder, you should see a number of errors that say plugin file does not exist when you go to the Plugins area on your site:

To fix this issue and regain the ability to manage your plugins, use your FTP program to change the name of the folder back to plugins. So, if you renamed it to plugins-disabled, just change it back to plugins.

Once you do that, you’ll see the full list of all your plugins again. Only now, they’ll all be deactivated:

Use the Activate button to reactivate them one-by-one.

Once you find the plugin that’s causing the issue, you can either reach out to the plugin’s developer for help or choose an alternate plugin that accomplishes the same thing (we’ve collected the best WordPress plugins here).

4. Deactivate CDN Temporarily

If you’re getting 403 forbidden errors on your assets (images, JavaScript, CSS), it could be a problem with your content delivery network (CDN). In this case, we recommend temporarily disabling your CDN and then checking your site to see if it works. If you’re a Kinsta client, click into your site and then on the “Kinsta CDN” tab. Once there, toggle the “Kinsta CDN” button off.

5. Check to See If Hotlink Protection Is Misconfigured

Hotlinking is when someone adds an image to their site, but the hosted link is still pointed to someone else’s site. To prevent this, some will set up what is called “hotlink protection” with their WordPress host or CDN provider.

When hotlink protection is enabled, it will typically return a 403 forbidden error. This is normal. However, if you’re seeing a 403 forbidden error on something you shouldn’t be, check to make sure hotlink protection is configured properly.

Still Having Issues? Reach Out to Your Hosting Provider

If none of the above solutions worked for you, then we recommend reaching out to your hosting provider. They can most likely help you pinpoint the issue and get you back up and running. If you’re a Kinsta client, open up a support ticket with our team. We are available 24/7.

Summary

The 403 Forbidden error means that your server is working, but you no longer have permission to view all or some of your site for some reason.

The two most likely causes of this error are issues with your WordPress site’s file permissions or .htaccess file. Beyond that, some plugin issues might also cause the 403 Forbidden error. Or it could be that something is misconfigured with hotlink protection or your CDN.

By following the troubleshooting steps in this guide, you should be able to get your site back to working in no time.

Does the term ‘403 forbidden’ seem familiar? This is a client-side error that denies you access to specific areas of a website. You might have seen it when you landed on a webpage with a permission error or an empty website directory.

Why? Because the majority of websites are configured to disallow directory browsing, with an aim to stop unauthorized users from getting into files containing sensitive data.

But if you or users run into a 403 forbidden error on your website, you need to fix it — or you could lose traffic. And that would cost you invaluable new customers over time.

However, as there are various causes for a 403 forbidden error, you have more than one solution to consider.

In this guide, we’ll explore everything you need to know about 403 forbidden errors, including likely causes and several solutions to try.

What Does the 403 Forbidden Error Mean?

The HTTP status code ‘403 forbidden — you don’t have permission to access this resource’ is displayed when a web server recognizes a user’s request but is unable to allow additional access.

What Causes the 403 Forbidden Error?

HTTP 403 forbidden errors are typically triggered by a client-side setup issue, so you should be able to fix it independently. One of the most common reasons for a 403 forbidden error is the settings for a specific folder or file. These determine which users can read, write, or execute that folder or file.

In this case, the site owner may have:

• Changed the settings and denied you from accessing the relevant resources.
• Failed to put the proper permissions in place.

Another common cause is the htaccess file settings, which may simply be wrong or (less simply) corrupt. This could occur after a file has been changed. Fortunately, you can fix this problem in an easy way — just create a new server configuration file.

Other possible causes of a 403 forbidden error include:

• Incorrect IP address: A domain name directs to an incorrect or outdated IP address hosting a site that prevents you from gaining access.
• Issues with a WordPress plugin: WordPress plugins that are incompatible with other plugins or set up incorrectly.
• New link to page: A site owner updates a page’s link, which differs from the version that has been cached.
• Malware: Malware infections can lead a .htaccess file to be in a state of ongoing corruption, so you would need to get rid of the infection before completing a file restoration.
• No index page: Your site’s homepage isn’t named ‘index.php’ or ‘index.html’.

Any of these causes may be responsible for your site’s 403 forbidden error.

Try These Techniques to Solve Your 403 Forbidden Error

The techniques we’ll explore below focus primarily on 403 forbidden errors associated with file access permissions. But alternative options, including malware scans and emptying your browser’s cache, could also fix the problem.

And while we focus on WordPress websites, you can apply our solutions to different types of sites too.

Assess the .htaccess File for Signs of Corruption

The .htaccess file usually remains inside the site’s document root..

Are you using cPanel or Plesk? First, find the File Manager, open the site’s document root directory, then search for the .htaccess file. Not there? In case of cPanel tap ‘Settings’ in the top-right area of the screen, then turn on the ‘Show Hidden Files (dotfiles)’ setting.

The .htaccess file primarily works by adjusting the settings for Apache Web Server, as it’s a server configuration file. But while you’ll find this file on the majority of sites by default, you have to manually make a new file if your site lacks one or it has been accidentally deleted.

In any case, when you find the file, take the following steps to find out whether the 403 forbidden error has been caused by an incorrect configuration:

1. Right-click on the file then tap ‘Download’ to make a backup.
2. Delete the file.
3. Try to access your site — if you can get into it, it’s safe to say that the file was corrupted.
4. If you want to make a new .htaccess file, sign in to your WordPress dashboard then click on the ‘Settings’ option followed by ‘Permalinks’.
5. Tap the ‘Save Changes’ button without making changes.

Completing these steps will create a new .htaccess file for your site. But if this process fails to fix the problem, move on to our next technique.

Resetting Permissions for the File and Directory

Incorrect file or folder permissions could be causing your HTTP 403 issue.

New files carry certain default permissions that determine how you read, write, and execute them. But you can edit permissions for files and folders with FTP. To get started:

1. Set up an FTP client and connect it to your site.
2. Right-click ‘publichtml’ after connecting the FTP client, then select ‘File Attributes’.
3. Input permission ‘755’ in the ‘Numeric value’ field, choose ‘Apply to directories only’, then press ‘ok’.

Generally, with regards to file permission numeric values, ‘755’ relates to folders, ‘644’ relates to static content, while ‘700’ relates to dynamic content.

Next, once you have adjusted your folder permissions, repeat the second and third steps above — but use ‘644’ in the ‘Numeric value’ field instead. Then, click on ‘Apply to files only’.

After you complete these steps, try to access your site to find out if you have fixed the problem.

Deactivating Plugins for WordPress

It’s likely that your 403 forbidden error is caused by a plugin which is faulty or simply incompatible if neither of the previous techniques have worked for you. So, we’ll explore how to disable plugins to discover if they’re behind the error.

Before we begin, though, we want to recommend that you disable all of the plugins at the same time rather than disabling them one by one.

Follow these steps:

1. Use FTP to get into your hosting account, or use the file manager in your hosting account, and navigate to the public_html -> wp-content folder.
2. Find the ‘plugins’ folder.
3. Change the folder’s name to something simple and relevant, such as ‘plugins-disabled’, to disable all of the plugins.

Next, try to access your site — if you don’t see the error again, the problem will have been caused by a plugin which is no longer active.

Change the folder name back to ‘plugins’, then disable one plugin at a time and see if the site continues to run properly. This will make it easy to identify the plugin causing the problem.

Either update or delete the plugin when you find it. But if the 403 forbidden error continues to appear, get in touch with your hosting provider for further help.

Index Page Uploading

Take a look at the name of your site’s homepage: it should be &lsquoindexphp’ or index.html’. Otherwise, you have two options to consider.

One possibility is to name your homepage either ‘index.php’ or ‘index.html’ instead. Alternatively, if you would prefer to retain the current name, just upload an index page to your public_html directory then set up a redirect to your present homepage.

Sounds good? Follow these steps:

1. Use FTP or the file manager in your hosting account to upload an index.php or index.html file to your public_html directory.
2. Find the .htaccess file and open it.
3. Enter this snippet of code to start redirecting the index.php or index.html file to your present homepage: 

Redirect index.html /myhomepagehtml

And make sure you swap ‘nyhomepage.html’ with the actual page name. 

Reconfigure Ownership of the File

Do you use VPS or Linux web hosting? Improper file ownership could be causing your 403 forbidden error problem.

Folders and files may be assigned to a specific Group, Owner, or even both. However, you’ll require SSH access to change ownership within these environments, as well as an SSH terminal for connecting to the VPS.

Use the following SSH command to assess ownership after you connect SSH to your site’s server:

ls -1 [file name]

You should see this (or something similar):

-rwxrw-rw- 1 [owner][group] 20 Jul 22 12:00 filename.txt

Focus on the owner and group elements: the username for your hosting account will be the proper ownership. If the ownership is different, enter the following chown Linux command to change that:

chown [owner][:group] [file name]

Check Your A Record

Another potential reason for your 403 forbidden error is that your domain name is pointing to the incorrect IP address, where you lack permission to view the site’s content. To get around that, verify that your domain name is pointing to the right IP address.

Your domain could still point to your previous web host if you have migrated to a new one and forgot about updating your nameservers. A 403 error status code will be triggered when your previous host terminates your account.

Run a Malware Scan

Your 403 error may be due to malware: your WordPress website may continually add unwanted code to the .htaccess file after becoming infected. The 403 error will continue even if you fix the file using our first suggested method.

So, run a scan of your site to find malware using a WordPress plugin like Wordfence or Sucuri. Most security plugins for WordPress can get rid of malware: you’ll be presented with various options when the plugin locates the infection, such as restoring or deleting the affected files.

Another way to restore your site is to use backup files or, if you’re missing a full backup of the necessary files, a database backup.

Empty Your Cache

Our final recommended technique for fixing your 403 forbidden error involves the cache and cookies in your browser. The cache retains data to help websites load more quickly next time you go back to it. But the real page link could be different from the cached one if a site has been updated.

Additionally, cookies may trigger an error too. That could be the case if you see the error when trying to sign in to a site that you log into frequently.

Fortunately, clearing out both the cache and cookies in your chosen browser could solve the problem. But be prepared: emptying the cache could cause a site to run more slowly the next time you visit it, as the browser will request the site’s files again. Also, emptying your cookies will log you out of any sites that you’re currently signed in to.

If you use Google Chrome like countless other people, take the following steps to clear out your cache and cookies:

1. Tap the ellipsis icon in the top-right area of the screen, then click on ‘Settings’.
2. Locate the ‘Privacy and security’ section, then tap the ‘Clear browsing data’ button.
3. Choose the data-deletion time period via the drop-down menu, then select both ‘Cookies and other site data’ and ‘Cached images and files’.
4. Tap the ‘Clear data’ button to proceed.

After finishing all four steps, go back to your site and sign in if necessary. Hopefully, the 403 forbidden error will be solved!

Conclusion

If you have run into 403 forbidden errors before, you’ll know just how annoying they can be, especially when they prevent you from accessing a website you depend on daily. They’re typically caused by file permission issues, though glitchy plugins and malware infections could be responsible too.

It’s not always easy to identify the reason for 403 errors, but the eight techniques explored in this guide should help you get your site running properly again.

However, there are plenty of HTTP error codes, and the 403 forbidden is just one of them. Website owners may face client- and server-side errors, including 404 and 504 gateway timeouts.

The more you know about these and other errors, the faster you will be able to fix them if they disrupt activity on your site.

Introduction

When a web server denies access to a particular webpage or web content, it displays the 403 Forbidden error. Different web servers report different variations of the 403 Forbidden error.

In this article, you will learn what a 403 error is and how to fix it.

The 403 Forbidden error happens when a web server denies access to a webpage to a user trying to access it trough a web browser. The name «403 error» derives from the HTTP status code that the web server uses to describe that type of error.

There are several variations of the error and several reasons why the web server has denied access. The following sections deal with the different ways the error is displayed and its causes.

Common 403 Error Messages

Like with other errors, webmasters can customize how the 403 error is displayed. Its contents also depend on the web server used. That is why there are many different 403 pages across different websites.

Some common 403 error messages are:

• 403 Forbidden
• HTTP 403
• Forbidden
• HTTP Error 403 – Forbidden
• HTTP Error 403.14 – Forbidden
• Error 403
• Forbidden: You don’t have permission to access [directory] on this server
• Error 403 – Forbidden
• 403 Forbidden Error
• 403 Error

The image above shows an example of a 403 Forbidden error served by an Nginx web server.

What Causes the 403 Forbidden Error

The 403 Forbidden error usually occurs due to access misconfiguration. The misconfiguration involves improper read, write, or execute permission settings for a file or directory.

Possible causes for the 403 Forbidden error are:

• An empty website directory. If there is no index.php or index.html page, the 403 error displays.
• Missing index page. The 403 error may occur if the homepage name isn’t index.html or index.php.
• Permission/ownership errors. Incorrect permission settings or ownership cause the 403 error.
• Incorrect .htaccess file settings. The .htaccess file holds important website configuration settings, and it could be corrupted.
• Malware infection. If your files are infected with malware, it can keep corrupting the .htaccess file.
• Cached outdated webpage. The 403 error comes up if the page link has been updated, which is now different from the cached version.
• Faulty plugin. Improperly configured WordPress plugins or their incompatibility could trigger the 403 error.

The following section deals with different ways of fixing the 403 Forbidden error.

How to Fix the 403 Forbidden Error (Tips for Webmasters)

You can do several things to fix the 403 Forbidden error, depending on whether you are a website visitor or a webmaster.

The following fixes for the 403 Forbidden error are resources for site webmasters:

Check Website Directory

An empty website directory may cause the 403 error. Make sure that the content is in the correct directory on the server.

Depending on the server you are using, the correct directory for your content is:

• For Nginx: /var/www/vhosts/domain.com/httpdocs/
• For Apache: /home/username/public_html/

If there is no such directory, create one.

Add an Index Page

The website homepage by default is index.html or index.php. If there is no such page on your website, the visitors can encounter a 403 Error. Resolve this by uploading an index page to your httpdocs or public_html directory.

If you already have a homepage named other than index, you can rename it or set up a redirect in your .htaccess file to that homepage.

To redirect to your homepage, follow the steps below:

1. Log in to cPanel and navigate to your public_html directory.

2. Right-click the .htaccess file and choose Edit from the dropdown menu.

3. Redirect the index.php or index.html file to your existing homepage by inserting the following code snippet:

redirect /index.html /homepage.html

Replace homepage.html with the actual name of your page.

Check File and Directory Permissions

Each file and directory on your website have permissions that control access to those files and directories. Incorrect file or directory permissions can cause the 403 Forbidden error. The permissions specify who has read or write access to the file or directory in question.

The permissions are represented with numeric values. The general practice is to use:

• 755 for directories
• 644 for static content
• 700 for dynamic content

You can change file permissions recursively with the chmod command. If you prefer a GUI, use an FTP client to change file or directory permissions.

Create a New .htaccess File

A 403 error can be the result of improper .htaccess file configuration. The .htaccess file controls the high-level website configuration.

Follow the steps below to check if the .htaccess file is the cause of the 403 error:

1. Find the .htaccess file via your file management software (e.g., cPanel) or via an sFTP or FTP client.

2. Right-click the .htaccess file and select Download to create a local backup.

3. Next, click Delete to delete the file.

4. Visit your website. If the 403 error no longer appears, it means that the .htaccess file was corrupt.

5. Now you need to generate a new .htaccess file. Log in to your dashboard and click Settings > Permalinks.

6. Don’t make any changes. Just click the Save Changes button to create a new .htaccess file.

Visit your website to check if the error is fixed.

Enable Directory Browsing

If the website shows a 403 error when you’re trying to browse a directory, you may need to enable directory browsing in your web server software. You can turn on directory browsing in the config file. If you don’t feel confident editing the config files yourself, seek help from a web master or your hosting provider.

The following examples show how to enable directory browsing in different web servers:

• IIS Express

1. Open the Web.config file of your project.

2. Add the following tags within <system.webServer>:

<directoryBrowse enabled="true" />
<modules runAllManagedModulesForAllRequests="true" />

• Nginx

Change the autoindex value to on in the config file:

The following is an example of the config file with the on value for autoindex.

server {
 listen 80;
 server_name phoenixnap.com www.phoenixnap.com;
 access_log /var/...........................;
 root /path/to/root;
 location / { index index.php index.html index.htm; }
 location /somedir { autoindex on; }
}

Apache

You have to specify the DirectoryIndex directive in the site’s .conf file (found in /etc/apache2/sites-available on Linux).

Turn on directory browsing in the Options directive. Following is an example of the .conf file with directory browsing turned on:

<Directory /usr/local/apache2/htdocs/listme>
  Options +Indexes
</Directory>

Contact the Hosting Company

The reason for the 403 Forbidden error could be with the hosting company and not with you. If everything else fails to remove the error, get in touch with your hosting company and let them check what could be causing the issue.

Disable WordPress Plugins

Sometimes, a faulty or incompatible plugin is what causes a 403 forbidden error. You can try to fix the error by disabling all plugins to check if the error goes away.

Follow the steps below to disable all plugins:

1. Log into the WP Admin and navigate to Plugins > Installed Plugins.

2. Select all plugins, choose Deactivate from the drop-down menu and click Apply.

3. Try to access your website. If there is no 403 forbidden error, that means that the cause was one of the plugins.

4. Now enable one plugin at a time to determine which one is causing the 403 error. When you find the root of the problem, update or remove the plugin or install an alternative one to resolve the issue.

Check the A Record

One of the reasons for the 403 Forbidden error can be a domain name pointing to the wrong IP address, where you don’t have the permission to view the content. This happens when the A record of a migrated website still points to the old IP address.

Follow the steps below to check if the domain A record points to the right IP address:

1. Log in to cPanel.

2. In the Domains section, click DNS Zone Editor.

3. In the list of DNS records, find the record with the A label in the Type column.

4. Check if the A record IP address in the Record column is correct. If it’s wrong, click Edit to change it.

5. Click Update to finish.

Revisit the website to see if the issue has been resolved.

Scan for Malware

Having malware on your web server can cause the 403 Forbidden error. The malware can keep injecting unwanted lines into the .htaccess file, and that way the error persists even if you generate a new .htaccess file.

Use a security plugin to scan your web server for malware and remove it if any is found. Most plugins also offer actions when detecting malware infected files, such as deleting the infected file or restoring it.

Some of the best security plugins for WordPress are Sucuri, Wordfence, Defender, etc.

How to Fix the 403 Forbidden Error (Tips for Site Visitors)

If you are a site visitor that has encountered the 403 error, below is a list of things you can try to fix the issue.

Check URL

A wrong URL is a common cause of the 403 Forbidden error. Make sure that you’re trying to access an actual webpage instead of a directory.

Many websites don’t allow visitors to browse through directories, so if you are trying to acces a directory, you will likely get a 403 Forbidden error.

Clear History/Cache

Your browser stores cached webpages to load them faster the next time you visit them. Sometimes the website link has been updated, making the actual link different from the cached version. Loading the cached version then results in a 403 error.

The stored cookies on your browser can also cause the 403 error. If the cookies are invalid or corrupted, they can cause improper server authentication. Clearing browser cache and cookies should resolve this issue.

Follow the steps below to clear the cache and cookies on Google Chrome:

1. Click the three-dot button on the top right corner and select Settings.

2. Find the Privacy and security section and click Clear browsing data.

1. In the drop-down menu, select the data deletion time frame.
2. Check the Cookies and other site data and Cached images and files options and click Clear data.

Try to reload the site to see if the problem persists.

Log in

A 403 Forbidden error code could sometimes appear because you need to log in to a website to access a page. If possible, log in with your credentials to gain access to the content.

Reload the Page

Sometimes, reloading the page is the trick to getting around the 403 Forbidden error. Each browser has its own reload button near the address bar. Press Ctrl+F5 on Windows and Linux or Cmd+Shift+R on Mac to reload the page if you prefer using the keyboard.

Try Later

If you aren’t the only one denied access to the website, then the problem is usually with the host. Revisit the site later and see if the issue has been resolved.

Contact Your ISP

If you cannot get around the 403 error on a website, but it works for other people, contact your internet service provider (ISP).

Your IP address could be added to a blocklist, and it is causing the 403 forbidden error. In that case, your ISP cannot help you, and the only way to access the website is to use a VPN.

Conclusion

High website availability provides the best user experience and shows reliability. That is why website owners try to keep their site available at all times and invest in website maintenance services.

Preventing or quickly resolving HTTP errors is crucial if you want to retain your visitors. After reading this guide, you should be able to promptly fix the 403 Forbidden error and keep your business running.