What 403 Forbidden means and why a server denies access to a website or page — no index file, permissions, .htaccess, server protection, SELinux — and how to fix it.
Contents
403 Forbidden means the server found the page but refuses to show it. Unlike a 404, the address is correct — it is access that is forbidden.
If you are a visitor
The site may have blocked access from your country, network or address — for example, if your IP address appears to be in another country or you are connecting through a VPN. Try visiting without the VPN or from a different connection.
No main file
If you open the address of a folder, such as example.co.uk/, the server looks in it for index.php or index.html. If there is no such file, the server won’t list the folder’s contents and returns 403. Check that your site’s files are directly in public_html and not in a subfolder — a common mistake after unpacking an archive. You can set your own main file in .htaccess: The .htaccess file.
File permissions
The web server needs permission to read files and enter folders. The usual permissions are 644 for files and 755 for folders. On shared hosting, you change permissions in cPanel’s File Manager; for details, see File and folder permissions. On your own server, see chmod and chown.
A deny rule in .htaccess
The lines Deny from all, Require all denied or Require ip … in .htaccess block access for everyone except the addresses you allow. Security plugins often add such rules. To check, temporarily rename .htaccess — if the site then opens, the cause is in that file.
Server protection
If the 403 appears only when you do something specific — saving a post in the admin area or submitting a form — the request may have been blocked by your site’s security plugin or by the server’s protection, which dislikes requests that look like an attack. Check the plugin’s settings, and if that isn’t the cause, contact our support team with the page address, the time and your IP address (you can find it with the IP lookup).
On your own server
- The nginx error log,
/var/log/nginx/error.log: a line withdirectory index of … is forbiddenmeans there is no main file;Permission deniedmeans a permissions problem. - You may lack permission to enter one of the folders along the path:
namei -l /var/www/example.co.uk/index.phpshows the permissions at each step. - AlmaLinux: the files have the wrong SELinux label — how to fix it.
Didn’t find the answer? Ask our support team — we’ll help.