Quick answer: A 403 Forbidden error means the server understood a request but will not permit access. Possible causes include permissions, security rules, restricted directories and website plugins. Check which URLs are affected and review logs before disabling protection or changing permissions.
403 Forbidden versus 404 and 500
A 403 response indicates an access refusal. A 404 generally means the requested resource was not found, while a 500 indicates a server error. The codes describe different outcomes, so the troubleshooting steps should differ.
1. Check the exact page and visitor
Does the problem affect everyone, only logged-out visitors, your own IP address or just the WordPress admin? Try another browser or network only as a diagnostic step. A single blocked administrator can be different from a whole website returning 403.
2. Check the server and security logs
Your hosting control panel or provider may expose web-server, ModSecurity or security-plugin logs. Match the refusal to the time, URL and request. Some security systems deliberately return 403 when they detect suspicious traffic. A false positive is possible, but the rule should be reviewed rather than disabling protection broadly.
3. Review folder and file permissions
Incorrect ownership or access permissions can cause 403 errors. Permissions depend on the hosting configuration, and a blanket change to 777 is unsafe. Ask your host to confirm the appropriate values if you are unfamiliar with the platform.
4. Check protected directories and access rules
Rules in .htaccess, server configuration or a security plugin can intentionally restrict URLs, files, user agents and IP addresses. Back up configuration files before changing them. If the restriction is intentional, do not remove it simply to make the error disappear.
5. Investigate recent changes
If the 403 started after a migration, new security plugin, CDN change or firewall update, compare that timeline against logs. Domain or DNS changes do not directly create an HTTP 403, but they may send visitors to a different server with different access rules.
6. Test plugins carefully
WordPress security plugins sometimes block login endpoints or specific requests. On a staging site, test a suspected rule or plugin setting, documenting the original value. Do not disable an entire firewall on a live site as your first step.
7. Check CDN and edge protection
A CDN or web-application firewall may return its own 403 page before the request reaches the hosting server. Look at whether the response identifies an edge service and use the appropriate access logs. If your website is protected by several layers, determine which one issued the response.
When should you contact your host?
Ask for help when the logs show a security rule you cannot interpret, when file ownership looks incorrect, or when public pages are unexpectedly blocked. Provide the URL, approximate time, your observed error and any request identifier shown. Avoid sharing passwords.
Frequently asked questions
Does a 403 error mean my site has been hacked?
No. It is an access refusal, not evidence of a compromise. Investigate before drawing conclusions.
Can browser cache cause a 403?
Authentication cookies and caching can affect what you see, but a genuine HTTP 403 is issued by the server or an intermediary.
Should I turn off ModSecurity?
Not as a routine fix. Ask your provider to inspect the specific rule and request first.
Can a site migration cause 403 errors?
It can expose permission, server configuration or access-rule differences. Use logs to identify the actual refusal.
Summary
Identify who is blocked and where, locate the layer returning 403, and review permissions and security logs. Make targeted adjustments only when you understand the reason for the restriction. For other WordPress server errors, see our 500 error troubleshooting guide.
For a wider look at prevention, see our small business website security guide.