403 Forbidden on a WordPress site
The request was understood and refused. The refusal came from the web server, a firewall or a permissions rule — WordPress is rarely involved.
403 Forbidden — You don't have permission to access this resource.
Note whether the whole site 403s or only some URLs, and whether it follows you or only affects one network. A site-wide 403 is nearly always file permissions or a rewrite rule; one that follows a single person is an IP block.
What causes it, most likely first.
Work down the list. Each check is written to rule its row in or out before you change anything, because the fixes below it are different and a guess costs more than a command.
| Cause | How to check | Fix |
|---|---|---|
| File or directory permissions the web server cannot read | The error is site-wide and constant. Directories should be traversable and files readable by the web server user; anything more restrictive produces exactly this. | Set directories to 755 and files to 644, owned by the user PHP runs as. A restore from a backup taken on a different host is the usual reason they drifted. |
| A security plugin has blocked your address | Other people can use the site normally and a different network works for you too. The plugin's log records the block with your address and a reason. | Clear the block from the plugin's own list, then raise the threshold that triggered it. Repeated failed logins are the most common trigger. |
| A rewrite or access rule denies the path | Only certain URLs fail — wp-login.php, wp-admin, xmlrpc.php — while the rest of the site is fine. | Find the deny rule in the server configuration or .htaccess. Hardening snippets copied from a tutorial are the usual source, and they often restrict more than intended. |
| The index file is missing or not listed | A directory URL 403s where a file URL in the same directory works. The server is refusing to list a directory that has nothing to serve as default. | Restore the missing index file, or confirm the document root points where you think it does. A misdirected root looks exactly like a permissions problem. |
Fixing it, step by step.
Commands assume WP-CLI and shell access. Where you have neither, each step says what it is doing so it can be done from the dashboard or over SFTP instead.
Establish the shape of the failure
Site-wide or one path; everyone or only you. Those two answers remove most of the list before any command is run.
curl -sS -o /dev/null -w '%{http_code}\n' https://example.com/ curl -sS -o /dev/null -w '%{http_code}\n' https://example.com/wp-login.phpRead the server's own explanation
A 403 is nearly always logged with a reason, and the reason names the layer that refused.
tail -n 50 /var/log/nginx/error.log
Reset ownership and permissions
Directories traversable, files readable, both owned by the PHP user. Run from the site root.
find . -type d -exec chmod 755 {} \; find . -type f -exec chmod 644 {} \;Take .htaccess out of the equation
Rename it rather than editing it, so you can put it back unchanged. WordPress rewrites a fresh one on request.
mv .htaccess .htaccess.bak wp rewrite flush --hard
Confirm from a different network
If the site answers from elsewhere while still refusing you, it is an address block and no amount of permission changing will help.
curl -sS -o /dev/null -w '%{http_code}\n' --interface eth1 https://example.com/
What the platform takes off the list.
File ownership is set to the site's own user at deploy and kept that way by the platform, so the permission drift that follows a manual restore does not happen here. Blocking is done at the edge rather than by a plugin inside WordPress, which means a blocked address never reaches PHP and, just as usefully, an administrator who locks themselves out can be let back in without database access.
Questions, answered.
Why can everyone else use the site while I cannot?
Should I set permissions to 777 to test it?
The 403 only appears on wp-admin. What does that suggest?
How is a 403 different from a 401?
If that was not it.
These fail in ways that look similar from the browser.