WordPress 403 Forbidden troubleshooting guide

WordPress 403 Forbidden: Diagnose Permissions, WAF and Access Rules

by

A WordPress 403 Forbidden error means the server received your request but is refusing to allow access to the requested page or resource.

You may see messages such as “403 Forbidden”, “Access Denied,” “You don’t have permission to access this resource,” or a security-related blocking page.

The error can affect your entire WordPress website, only the admin area, a plugin page, a media file, or even a single visitor or IP address.

Common causes include security rules, incorrect file permissions, a damaged .htaccess file, plugin conflicts, CDN or firewall blocks, and hosting-level restrictions.

QUICK ANSWER

If WordPress shows a 403 Forbidden error, first test the site in another browser or network. Then temporarily disable security plugins, clear CDN and server caches, check file and folder permissions, regenerate .htaccess, review firewall or ModSecurity rules, and ask your hosting provider to identify the rule blocking the request.

What Does a 403 Forbidden Error Mean in WordPress?

An HTTP 403 response is different from a normal WordPress 404 or 500 error.

A 404 means the requested page could not be found.

A 500 error means the server encountered an internal problem while processing the request.

A 403 error generally means the server recognizes the request but refuses to serve the resource.

You may encounter the error when:

  • opening the homepage,
  • logging into WordPress,
  • opening /wp-admin/,
  • installing a plugin,
  • uploading media,
  • saving a post,
  • accessing a specific URL,
  • or using WordPress from a specific IP address.

The location of the error is an important troubleshooting clue.

1. Test Another Browser, Device, and Network

Before changing WordPress files, determine whether the 403 error affects everyone or only you.

Try opening the website using:

  • a private or incognito browser window,
  • another browser,
  • another computer or phone,
  • mobile data instead of Wi-Fi,
  • or another internet connection.

If the site works from another network, your IP address may have been temporarily blocked by a firewall, security plugin, CDN, or hosting security system.

This can happen after:

  • too many failed login attempts,
  • repeated admin requests,
  • security scanning,
  • VPN usage,
  • or firewall rules mistakenly identifying normal traffic as suspicious.

If the error appears for every visitor, continue troubleshooting the WordPress and server configuration.

2. Temporarily Disable Security and Firewall Plugins

Security plugins are designed to block suspicious requests, but an incorrect rule can also block legitimate administrators or visitors.

Pay particular attention to:

  • firewall plugins,
  • login security plugins,
  • anti-spam plugins,
  • country blocking tools,
  • IP blocking plugins,
  • and malware/security plugins.

If you can access the WordPress dashboard, temporarily deactivate the security plugin and test the affected URL again.

If You Cannot Access wp-admin

Open your hosting file manager or connect through FTP/SFTP.

Navigate to:

/wp-content/plugins/

Find the suspected security plugin folder and temporarily rename it.

For example:

security-plugin

could temporarily become:

security-plugin-disabled

Then reload your website.

If the 403 error disappears, restore the original folder name and review the plugin’s firewall, IP blocking, or access-control settings.

If you cannot reach the login page itself, see our WordPress Login Not Working? 8 Fixes guide.

3. Check WordPress File and Folder Permissions

Your web server needs permission to read WordPress files and enter the required directories.

If permissions are too restrictive, the server may return a 403 Forbidden response.

Use your hosting file manager or FTP/SFTP to inspect your WordPress installation.

Common permission values on many Linux-based WordPress servers are:

  • 755 for directories,
  • 644 for files.

These values are common defaults, but your hosting environment may use different ownership or permission requirements.

Important directories include:

  • wp-admin,
  • wp-content,
  • wp-includes,
  • wp-content/plugins,
  • wp-content/themes,
  • and wp-content/uploads.

Do not change all permissions to 777. That can create a serious security problem and does not properly fix incorrect ownership.

If the permissions appear correct but access is still denied, ask your host to verify file and directory ownership.

4. Regenerate the WordPress .htaccess File

On Apache-based servers, WordPress uses .htaccess for rewrite and access rules.

A corrupted or incorrectly edited .htaccess file can cause a 403 error.

Before making changes, download a backup copy.

If you can access the dashboard, try:

Settings → Permalinks → Save Changes

You do not need to change your permalink structure.

Saving the page can regenerate WordPress rewrite rules.

If You Cannot Access the Dashboard

Open your site’s root directory and locate:

.htaccess

Rename it temporarily to:

.htaccess-old

Then test the website.

If the site begins working, the previous file contained a rule responsible for the problem.

After regaining dashboard access, go to:

Settings → Permalinks

and save the settings to allow WordPress to create a new file.

Do not permanently remove custom server rules until you understand what they do.

5. Check Your Hosting Firewall and ModSecurity

Many hosting providers use a web application firewall or a security system such as ModSecurity.

These systems inspect requests before WordPress processes them.

A firewall rule may incorrectly block:

  • saving certain post content,
  • plugin installation,
  • REST API requests,
  • AJAX requests,
  • file uploads,
  • form submissions,
  • or specific URLs.

A useful clue is when the website works normally until you perform one specific action.

For example, you may be able to open wp-admin but receive a 403 error only when saving a page containing a particular script or URL.

Check your hosting control panel for:

  • ModSecurity,
  • Web Application Firewall,
  • Security Logs,
  • Blocked Requests,
  • or IP Access rules.

If you cannot identify the rule, contact your host and give them the exact time and URL that produced the 403 response.

They can often identify the firewall rule from the server logs.

6. Check Cloudflare, CDN, and IP Blocking Rules

If your site uses Cloudflare or another CDN, the request may be blocked before it reaches your WordPress server.

Review:

  • firewall rules,
  • WAF rules,
  • IP blocks,
  • country restrictions,
  • rate limiting,
  • bot protection,
  • and cached error responses.

Temporarily test the site without your VPN if you are using one.

You can also try accessing the site through mobile data to see whether only your current IP is blocked.

If a CDN firewall rule is responsible, do not simply disable all website security permanently.

Identify the specific rule or IP block and adjust only what is necessary.

After changing CDN or firewall settings, clear the CDN cache and test again.

7. Disable Other Plugins to Find a Conflict

A 403 error is not limited to dedicated security plugins.

Other plugins may add rewrite rules, block API requests, change access permissions, or interact with the server firewall.

Possible examples include:

  • caching plugins,
  • redirect plugins,
  • membership plugins,
  • SEO plugins,
  • CDN plugins,
  • media protection plugins,
  • and login customization plugins.

If the error started after installing or updating a plugin, temporarily deactivate that plugin first.

If you are unsure which plugin caused the problem, temporarily disable all plugins and test again.

If the 403 disappears, reactivate plugins one at a time until the error returns.

This identifies the plugin responsible without changing several server settings at once.

8. Check Server Logs and Ask Your Hosting Provider

If WordPress settings, plugins, permissions, and .htaccess appear normal, the server logs are the next place to look.

Your hosting dashboard may provide:

  • access logs,
  • error logs,
  • ModSecurity logs,
  • firewall logs,
  • and blocked-request reports.

Reproduce the error once and note the exact time.

Then search the logs for the affected URL or request.

If you contact hosting support, provide:

  • the exact 403 message,
  • the URL that fails,
  • the time the error occurred,
  • whether the error affects everyone or only your IP,
  • and what action triggered it.

A hosting provider can determine whether Apache, Nginx, ModSecurity, a firewall, file ownership, or another server rule is rejecting the request.

Why Does WordPress Show 403 Only on wp-admin?

If the public site works but /wp-admin/ returns a 403 error, focus on access-control systems first.

Possible causes include:

  • a security plugin blocking your IP,
  • login protection rules,
  • a hosting firewall,
  • incorrect permissions in wp-admin,
  • an .htaccess rule,
  • or server restrictions placed specifically on admin URLs.

Try opening:

/wp-login.php

directly.

If that also returns 403, test another network or temporarily disable the relevant security plugin using the file manager.

Why Do I Get 403 When Installing or Updating a Plugin?

If the error appears only when installing or updating plugins, the problem may involve:

  • security rules blocking the request,
  • WordPress directory permissions,
  • server ownership,
  • a plugin conflict,
  • or hosting restrictions.

Check whether WordPress can write to:

/wp-content/plugins/

Also review your hosting security logs immediately after reproducing the error.

If WordPress instead becomes stuck after an update, troubleshoot the maintenance process separately rather than treating it as a 403 problem.

Why Do Only Some Visitors See the 403 Error?

When only certain visitors receive a 403 response, the website itself may still be functioning normally.

Look for rules based on:

  • IP address,
  • country,
  • VPN usage,
  • browser behavior,
  • request frequency,
  • or bot detection.

Security systems can occasionally create false positives.

Check firewall logs before permanently whitelisting an IP address so you understand why the request was blocked.

403 vs 404 vs 500: Which Error Do You Have?

These errors require different troubleshooting approaches.

  • 403 Forbidden: the server refuses access.
  • 404 Not Found: the requested URL cannot be found.
  • 500 Internal Server Error: the server failed while processing the request.

If your page is missing rather than blocked, see our WordPress 404 Error? 8 Fixes guide.

If the site displays an HTTP 500 response, use our WordPress 500 Internal Server Error? 8 Fixes guide instead.

Can a 403 Error Mean My WordPress Site Was Hacked?

Not necessarily.

A 403 error is commonly caused by legitimate security or server configuration.

However, unexpected changes to WordPress files, suspicious redirects, unknown administrator accounts, or modified .htaccess rules can also indicate a compromised website.

If you notice other signs of compromise, see our WordPress Site Hacked? 9 Steps guide and investigate the security issue separately.

Final Checklist

If WordPress displays a 403 Forbidden error, check these items in order:

  1. Test another browser, device, and internet connection.
  2. Temporarily disable security and firewall plugins.
  3. Check file and directory permissions.
  4. Regenerate or inspect .htaccess.
  5. Check hosting firewall and ModSecurity rules.
  6. Review Cloudflare or CDN blocking rules.
  7. Test for other plugin conflicts.
  8. Review server logs or contact your hosting provider.

The most important step is identifying where the block occurs. If WordPress never receives the request, changing themes or editing posts will not solve the problem. Check the security and server layers first, then narrow the issue down one change at a time.

Leave a Comment