403 Forbidden Error
Instead of your page, visitors see "403 Forbidden" or "Access Denied" — the server understood the request but refused to show the page.
Common signs of this issue
- The page reads "403 Forbidden," "Access Denied," or "You don't have permission to access this resource."
- It may affect the whole site, just one page, or only the admin/login area.
- Some visitors see it while others don't — a clue that a firewall is blocking specific people or regions.
- It appeared after a plugin update, a security plugin change, or moving the site to a new host.
- You can sometimes still reach the site from your phone on mobile data, but not from your office connection.
Safe checks you can do yourself
None of these require sharing passwords with anyone.
- Try the page from a different device and a different connection (phone on mobile data). If it works there, your own IP address is probably being blocked, not the site itself.
- Note exactly which pages show the error — the whole site, one folder, or just
/wp-admin. That narrows the cause a lot. - Think about what changed just before it started: a security plugin, a firewall setting, a host migration, or an edit to
.htaccess. - If you use a security service like Cloudflare, Sucuri, or Wordfence, check its dashboard for a "blocked requests" or firewall log — the block is often listed there with a reason.
- Ask one or two customers (or check from another country using a free "check site from multiple locations" tool) to see whether the block is only hitting certain regions.
- Check your hosting control panel for a security or "IP blocker" section — hosts sometimes add blocks automatically after repeated failed logins.
- Confirm your hosting bill and domain are paid up — some hosts show 403-style pages on suspended accounts.
What this usually means
A 403 means the server is working but refusing to serve the page. That's different from a 404 (page doesn't exist) or 500 (server broke). Something is actively saying "no" — and the usual suspects are file permissions, a rule in .htaccess, a security plugin or firewall, or a host-level block.
If only some people see it, it's almost always a firewall or security rule that's too aggressive — often triggered by failed login attempts, a country block, or a rule added during an attack.
If everyone sees it on every page and nothing was changed on purpose, the cause is usually wrong file permissions after a migration, a missing index file, or a hosting-account suspension dressed up as a 403.
What not to do
- Don't change file permissions in bulk (like setting everything to 777) — that creates a real security hole and many hosts will suspend the account for it.
- Don't delete .htaccess outright; it usually contains rules your site needs. A backup copy first, always.
- Don't uninstall your security plugin in a panic — the block it created can outlive the plugin and get harder to find.
- Don't keep retrying a blocked login over and over; many firewalls extend the block each time you do.
When to get help
A 403 is usually quick for someone experienced to trace: the firewall log or server error log names the rule doing the blocking. If the whole site is down for real visitors — or you're locked out of your own admin — that's costing you money by the hour, and a short professional session is usually cheaper than a day of guessing.
Could your hosting be the problem?
If your host is slow, unreliable, or hard to deal with, moving to a better one can clear up issues like this for good. One we genuinely recommend is Instant Access Internet Services — a smaller, compassionate company with 30 years in the business, known for being one of the fastest, with great management and low pricing. (Just a recommendation — no affiliate link, no kickback.)
Not sure what to do next?
Answer a few short questions and we'll point you to the safest next step — DIY, a freelancer, or a direct review. No passwords required.
Is this a business website? If this issue may be costing you leads, sales, or trust, you may want a direct review instead of trial and error.
Frequently asked questions
What's the difference between a 403 and a 404?
A 404 means the page wasn't found. A 403 means the page (or folder) exists but the server refused to show it — permissions, a firewall, or a security rule said no.
Why do I get a 403 but my customers don't (or vice versa)?
A firewall is blocking specific IP addresses or regions. That's common after repeated failed logins from your connection, or a too-broad country block.
Can a 403 error mean I've been hacked?
Occasionally — some malware edits .htaccess and breaks access, and some hosts lock a site to 403 when they detect an infection. If the 403 came with a warning email from your host, treat it as a security issue.
Will clearing my browser cache fix a 403?
Rarely, but it's free and safe to try. If the error persists across devices and networks, the cause is on the server side, not in your browser.
Why did a 403 appear right after moving hosts?
File permissions and ownership often change during a migration. It's a routine fix for the new host's support team — ask them before changing anything yourself.