How to fix a 403 Forbidden error on your own website

What a 403 error means

"403 Forbidden" means the web server found what was asked for but is not allowed to serve it. Unlike a 500 error, nothing crashed; a rule or a permission said no. This article is for your own website on cPanel or Plesk hosting.

A quick way to narrow it down:

What you see	Likely cause
Whole site 403 just after upload	Missing index file or files in the wrong folder
One folder or file 403	Permissions or a .htaccess rule in that folder
403 when submitting a form or saving a post	ModSecurity or a security plugin blocking the request
403 only from your office or home	Your IP address is blocked

Steps to fix it

1. Confirm an index file exists. Open File Manager and check that index.php or index.html sits directly inside public_html (or the domain's document root; in Plesk this is usually httpdocs). A common mistake is uploading a folder so the files end up in public_html/mysite/. Move them up one level. See uploading files with File Manager or FTP.

2. Fix permissions. Files should be 644 and folders 755. In File Manager, select the item, choose Permissions and set the numbers. If many files are wrong, an FTP client such as FileZilla can apply permissions to files and folders separately. Do not use 777; on many servers it causes errors instead of fixing them.

3. Check .htaccess for deny rules. Show hidden files and open .htaccess in public_html and in the failing folder. Look for lines such as:

   Require all denied
   Deny from all
   Options -Indexes
   

   Options -Indexes is normal and only blocks folder listings, which is why a folder without an index file shows 403. The first two block everyone. Rename the file to .htaccess-old to test, then fix or remove the rule.

4. Review cPanel security tools. Check Security > IP Blocker for your own IP address, Security > Hotlink Protection if images fail on other sites, and Files > Directory Privacy if a folder asks for a password. Menus vary by version and by what your host enables.

5. Check ModSecurity if the 403 appears when you submit a form, save a page in WordPress or upload a file. In cPanel's Security > ModSecurity page (where available), note whether it is on for the domain. Rather than switching it off, collect the time and URL and ask support which rule fired.

6. Disable security plugins temporarily. In WordPress, rename the folder of plugins such as firewall or login protection plugins inside wp-content/plugins, test, and rename it back once you know.

7. Check your IP block on the server firewall if only you see the error. Find your public IP by searching "what is my IP" and send it to support.

How to confirm it worked

• The page loads in a private window and from mobile data.
• The action that failed (form submission, saving a post) now succeeds.
• New lines in Metrics > Errors stop appearing for that URL.

If the 403 turns into a 500, you have moved past the permission problem and something else needs fixing; see fixing a 500 error. For other symptoms, use the hosting errors troubleshooting guide.

If it still fails

Open a support ticket and include:

• The exact URL and whether the whole site or one path fails
• The time you last saw it (IST) and your public IP address
• What you were doing: viewing, logging in, submitting a form, uploading
• Any lines from Metrics > Errors mentioning that URL
• Changes you made just before it started