Fix "403 Forbidden" on Your Website

A 403 means the server understood the request but refuses to serve it. The cause is almost always permissions, an .htaccess rule, or a missing index file. Here is how to fix it.

Cause 1: wrong file/folder permissions

Files the web server can't read return a 403. Reset web permissions — folders 755, files 644:

find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;

Cause 2: an .htaccess rule

A Deny/Require rule or a broken rewrite blocks access. Rename .htaccess to test; if the 403 clears, the rule was the cause — regenerate a clean one.

Cause 3: no index file

If a folder has no index.html/index.php and directory listing is off, the server returns 403 instead of showing the files. Add an index file (or enable listing if you intend to show it).

Cause 4: an IP / security block

A firewall, ModSecurity rule or an IP deny-list can 403 specific visitors. Check the server's error log — it names the rule or IP that triggered the block.

403 = refused, not missing. Check permissions (755/644), test .htaccess, add an index file, and read the error log.

Cause 5: ownership mismatch on shared hosting

If files were uploaded via SSH/root and end up owned by a different user than the one PHP-FPM/the web server runs as, that mismatch alone can trigger 403 even with seemingly correct permission numbers. Check ownership with ls -l as well as the mode bits, and chown files to the correct hosting user.

Cause 6: a WAF or CDN rule (e.g. Cloudflare)

A security rule at Cloudflare or another CDN/WAF layer can 403 a request before it even reaches your server. If the error page doesn't look like your server's normal 403 page, check the CDN/WAF dashboard for a firewall event log first.

How to prevent 403 errors

• Set permissions correctly at upload/deploy time (755 dirs, 644 files) rather than fixing them after the fact.
• Keep an untouched backup of a known-good .htaccess.
• Always leave an index file in public folders, or explicitly enable directory listing if that's intended.
• Review WAF/ModSecurity rule changes before rolling them out broadly.

Related errors

If permissions are the real issue at the OS level, not just the web server, see permission denied on Linux. A 403 that keeps bouncing between pages is usually really a redirect loop, not a permissions problem. For a fatal application error instead of a block, see 500 Internal Server Error.