How to fix the “403 Forbidden” error in 2024

“403 Forbidden” is a standard HTTP status code indicating that the web server understands the request but refuses to authorize it. This could be due to permission issues, incorrect file permissions, or server configuration problems.

An example of 403 Forbidden error

Here are potential causes that can trigger this error:

  • Misconfigured file and folder permission settings. Prevents users from accessing sensitive files or certain parts of a website, often leading to a “403 Forbidden” error.
  • Corrupt .htaccess file. Misconfiguration and malware can break the .htaccess code.
  • Missing index page. The index.html or index.php file, which is the default homepage template, isn’t available in the website’s directory.
  • Incompatible WordPress plugin. A WordPress plugin might be conflicting with another plugin or was incorrectly configured.
  • Incorrect IP address. The domain name points to an inaccurate IP address whose website blocks your access.
  • Malware scan. Your website’s security measures can limit access to specific resources to prevent malicious attacks.
  • New web page link. The webpage link was recently updated, making it different from the cached version.
  • Empty website directory. The URL is trying to access your website’s directory instead of a file.

Download comprehensive HTTP status codes cheat sheet

403 forbidden errors are often caused by incorrect settings for certain files or folders, restricting access. You can usually resolve this by adjusting these settings to allow proper permissions.

Error code403 Forbidden Error
Error typeClient-side error
Error variationsForbidden: You don’t have permission to access [directory] on this server
HTTP Error 403 – Forbidden
Error 403 – Forbidden
403 Forbidden request forbidden by administrative rules
403 Forbidden
Access Denied – You don’t have permission to access
Error 403
HTTP 403
Forbidden
Error causesAccess misconfiguration
Corrupt .htaccess file
Missing index page
Broken WordPress plugin
Wrong IP address
Malware infection
New web page link
Empty website directory

How to fix the “403 Forbidden” error

If you discover pages returning a “403 Forbidden error” either by using a website crawler or by simply noticing it, there’s no need to panic. Here are 12 effective ways to ensure that your website remains accessible and operates optimally.

These solutions will help you resolve and prevent potential downtime, keeping your site running smoothly.

1. Clear your browser cache and cookies

The browser cache speeds up website loading on future visits. However, if the web page’s link changes, it can cause a mismatch with the cached version and trigger the 403 HTTP status code. Browser cookies – small files that remember your preferences and details – are also a common culprit of the “403 Forbidden” error.

While cache is dedicated to improving website loading speed, cookies focus on personalizing your browsing experience. That’s why a forbidden page error usually occurs on a frequently logged-in website.

Keep in mind, that this method will force the browser to re-request site files, requiring you to sign in again on most websites.

Here are the steps to clear cache and cookies on Google Chrome. The steps are similar in Firefox and Safari:

  1. Click on the three-dot icon in the top right corner and select Settings.
  2. Locate Privacy and securityClear browsing data.
Google Chrome's Privacy and security highlights Clear browsing data
  1. Use the drop-down menu to choose the time range. We recommend choosing All time to remove all the old files. Then, select Cookies and other site data and Cached images and files.
  2. Click Clear data to erase them.
Google Chrome's Clear browsing data highlights the Clear data button

After completing these steps, try revisiting and logging into the problematic website to see if it fixes the error. This method also works for other errors, like the 400 Bad Request.

2. Temporarily disable VPN

A virtual private network (VPN) can trigger a “403 Forbidden” error on websites that block access from VPN servers due to security or regional restrictions.

To test this theory, temporarily disconnect your VPN and retry accessing the web page. If this resolves the error code, consider switching to a different VPN server or contact your VPN provider.

3. Temporarily disable CDN

A content delivery network (CDN) is a network of servers that caches and delivers content from the closest web server to the user, reducing load times and bandwidth usage.

If your website uses a CDN, it may cache a “403 Forbidden” error due to issues like file permissions, IP blocking, and incorrect .htaccess rules. Temporarily bypassing CDN helps determine whether the source of the error is the original web server or the CDN itself.

We automatically enable our in-house CDN for our Business Web Hosting plan and above. Follow these steps to troubleshoot “403 Forbidden” by disabling Hostinger CDN temporarily:

  1. Navigate to Performance CDN from hPanel.
  2. Find the CDN status section and click Disable.
Hostinger CDN status in hPanel
  1. If this fixes the issue, keep the CDN disabled for now and contact our support team for troubleshooting assistance.

4. Scan for malware

.htaccess is a web server configuration file that primarily works by altering the Apache web server settings. Located in your website’s root directory public_html, it contains a set of rules for how your website should behave in certain situations, including who can access what resources or pages.

If your WordPress site is infected with malware, unwanted code can be injected into the .htaccess file. Having the rules changed can cause the HTTP status code 403.

Hostinger users can leverage our built-in scanner to remove malware in WordPress. You don’t need to purchase third-party integrations because the automated tool can scan your websites for malware for free.

Here’s how to do it:

  1. On hPanel, navigate to Security → Malware Scanner.
  2. If no malware is found, this section will display your hosting plan’s name and the time since the last scan.
  3. Otherwise, the malware scanner will summarize detected malicious files in the past 30 days and the actions taken to fix them.
Hostinger Malware Scanner interface when it detects malware in the last 30 days

For extra security, use a WordPress malware scanner plugin to identify malicious software on your WordPress website. The top WordPress security plugins, such as Sucuri and Wordfence, offer this feature.

If the error persists after fixing the infected file, we recommend creating a new .htaccess file.

5. Restore the .htaccess file

If your .htaccess file is infected or misconfigured, replace it using an FTP client or file manager.

For Hostinger users, follow these steps to locate and create a new .htaccess file. If you’re using cPanel, the steps should be similar:

  1. On hPanel, navigate to FilesFile Manager.
  2. Open the public_html directory and locate the .htaccess file. Right-click on it and select Download to create a backup on your local computer.
Hostinger File Manager highlights the Download button over .htaccess file
  1. Delete the current .htaccess file from your hosting account.
  2. Create a new server configuration file by clicking New file and naming it .htaccess without any extensions.
Hostinger File Manager's New file popup highlights the Create button
  1. Copy the following code to the new file, then Save it.
# Enable URL Rewriting
RewriteEngine On
# Rewrite rule to redirect requests to index.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?/$1 [L]

Pro Tip

Check out our guide for tips on using File Manager at Hostinger to manage website files. We also have a tutorial covering the server configuration file in greater detail, including how to locate it in cPanel.

Alternatively, follow these steps for WordPress websites:

  1. Log in to your WordPress dashboard and select Settings → Permalinks.
  2. Click the Save Changes button at the bottom without making any modifications. It will generate a new .htaccess file for your WordPress site.
WordPress Permalinks section highlights the Save Changes button

Try to re-access the web address. If this method fixes the “403 Forbidden” error code, it indicates a corrupted .htaccess file.

6. Reset file and directory permissions

Websites have unique file permissions that control how users can read, write, and execute data. If misconfigured, it can cause HTTP 403 forbidden errors.

With Hostinger, you can fix file permission issues in just one click. To access the built-in tool on hPanel, look up Fix File Ownership in the search bar.

Select the confirmation checkbox and click Execute. The tool will automatically assign default permissions to all website files and folders.

The confirmation popup of Hostinger Fix File Ownership

Alternatively, configure an FTP client like FileZilla to reset file and folder permissions manually. Keep in mind that this method requires an understanding of FTP protocol and file permissions.

Here’s how to reset file permissions using FileZilla:

  1. Make sure FileZilla is connected to your website.
  2. Right-click on the public_html directory and select File Attributes.
FileZilla FTP highlights the File Attributes option
  1. In the Numeric value field, enter 755. This value allows only the owner to read, write, and execute the file or directory, preventing others from modifying it.
FileZilla FTP highlights the numeric value field in the Change file attributes popup, giving the directory file permissions 755
  1. Select Apply to directories only, and click OK.
  2. After changing directory permissions, repeat steps 2 and 3. This time, enter 644 in the Numeric value field and select Apply to files only. The 644 value allows the owner to read and write, while others can only read.
FileZilla FTP highlights the numeric value field in the Change file attributes popup, giving the directory file permissions 644

After applying the correct permissions, reaccess your website to check if the permission error persists.

Are You on Linux?

Check out our article on how to change file permissions and owners in Linux.

7. Disable WordPress plugins

If the previous methods fail, check whether an incompatible or problematic WordPress plugin is causing the HTTP 403 error.

Hostinger users can disable their WordPress plugins straight from hPanel. Go to WordPress Security and scroll down to the Installed plugins section. Then, click on the toggle to disable each plugin individually.

WordPress installed plugins in hPanel

If you’d rather disable the plugins manually, use a file manager or an FTP client. Here’s how to do it via the hPanel file manager:

  1. Navigate to the wp-content folder in public_html.
  2. Locate the plugins folder and rename it to disabled-plugins. This will make the folder temporarily unrecognizable by the web server, deactivating all plugins simultaneously.
Hostinger File Manager highlights the disabled-plugins directory
  1. Now, try accessing your website. If HTTP error “403 Forbidden” is gone, a problematic plugin was likely causing the issue.
  2. Revert the folder’s name to plugins to re-enable all plugins.
  3. Go to Plugins Installed Plugins from your WordPress dashboard and Deactivate all plugins one by one. Whenever you deactivate a plugin, check if it resolves the error. This step will help identify the faulty plugin.
  4. Once identified, update or remove the plugin to fix the issue.

8. Verify the A record

The “403 Forbidden” error can occur if your domain points to an incorrect IP address, denying you access even with valid credentials. To prevent this, ensure your domain points to your hosting provider’s IP address.

Hostinger users can navigate to Plan Details on hPanel to find their website’s IP address.

Locating website IP address in hPanel

Follow these steps to check if the domain A record is pointed correctly via hPanel:

  1. From the hPanel dashboard, navigate to AdvancedDNS Zone Editor.
  2. You will find a list of DNS records. Locate the A records by scanning the Type column.
  3. Examine the IP addresses in the Content column.
Hostinger DNS Zone Editor highlights the A records
  1. If the A records don’t point to the correct IP address, click Edit to modify them. Once you’re done, click Update.

Editing an existing A record may affect any services or subdomains currently using it. If changing the existing A records doesn’t resolve the error or disrupt other operations, consider creating a new one.

On hPanel, you can create a new A record in the Manage DNS Records section. Select A as the Type and input the valid IP address in the Points to field. Then, click Add Record.

Adding a new DNS record in Hostinger's DNS Zone Editor

9. Update nameservers

If you’ve migrated to a new hosting provider and forgot to update your nameservers, your domain might still point to the old host and lead to a 403 error status code.

To resolve this issue, you must update your domain’s nameservers.

If you have recently migrated to Hostinger, here’s how to change your nameservers to Hostinger’s:

  1. Go to Domains and select Manage next to your domain.
A list of domains in hPanel, highlighting the button to manage them
  1. Click on the Change link in the Nameservers section.
The Domain Information section in Hostinger Domains highlights the Change button next to Nameservers
  1. Pick the Use Hostinger nameservers option and click Save.
Changing nameservers to Hostinger's default

10. Upload an Index page

The following methods are more technically complex. If you’re unsure of the steps, contact your hosting provider’s support team for troubleshooting assistance.

Most web servers disallow directory browsing for security reasons. Instead of showing what’s inside a folder on the page, they’ll show a standard web page.

Moreover, attempts to access a directory without a standard web page, usually in index.html or index.php format, result in a “403 Forbidden” error message.

First, check whether your website’s homepage name is index.html or index.php. If not, rename it in the FTP client or file manager.

Another way to resolve this issue is to upload an index page to your public_html directory and create a redirect to your existing homepage. Here’s how to do it:

  1. Access the public_html directory using an FTP client or file manager.
  2. Create a New File named index.html or index.php inside the root directory.
  3. Open the .htaccess file in the root directory. Insert the following code snippet to redirect index.php or index.html to your existing homepage. Be sure to replace homepage.html with the actual name of your page.
Redirect /index.html /homepage.html
  1. Save the changes, then check your website’s homepage to see if the problem is resolved.

Whichever method you choose, we strongly advise against enabling directory browsing to resolve the “403 Forbidden” error. This can expose your directory’s content to the public, leading to security risks.

11. Edit File Ownership

Incorrect file ownership can trigger the “403 Forbidden” error, particularly in Linux-based computers or VPS hosting. If you’re using a VPS with SSH access, you can modify file ownership by connecting your VPS to an SSH client like PuTTY.

After connecting to the SSH server, check the ownership using the following SSH command:

ls -l [file name]

The result will resemble the following:

-rwxrw-rw- 1 [owner][group] 22 Sep 22 10:00 filename.txt

Pay attention to the owner and group sections. The correct ownership should match your hosting account’s username. Otherwise, utilize the chown Linux command to adjust file ownership.

Here’s the basic syntax for the chown command:

chown [owner][:group] [file name]

For example, if your username is John, use the command below:

chown John filename.txt

12. Use Hostinger AI Troubleshooter

Although still in beta, Hostinger’s built-in AI Troubleshooter provides a practical solution to troubleshooting. Hostinger users can use it to fix the “403 Forbidden” error with a few clicks.

Here’s how to use Hostinger AI Troubleshooter:

  1. On hPanel, navigate to WordPress → AI Troubleshooter (beta). You can check the Help page to see if it detects the “403 Forbidden” error on your website.
Hostinger AI Troubleshooter detects an error on the website
  1. Click on the Fix with AI assistant button to see its troubleshooting recommendations.
  2. Select Fix my website if you approve its corrective action. Otherwise, choose Try another solution so the AI will come up with another solution.
The workflow of Hostinger AI Troubleshooter

More Reasons to Use Hostinger

Besides AI Troubleshooter, all our WordPress hosting plans come with an object cache feature, auto-updates, and vulnerabilities scanner for optimal website performance and user experience. Take advantage of the 30-day money-back guarantee to test our hosting services risk-free.

Learn how to fix the “403 Forbidden” error with Hostinger Academy

Watch this video if you need help visualizing the troubleshooting steps.

Subscribe For more educational videos! Hostinger Academy

Conclusion

The “403 Forbidden” error can disrupt your website’s functionality and lead to a poor user experience. Multiple causes can trigger this HTTP error, including incorrect file permissions, a corrupted .htaccess file, faulty plugins, and IP blocking errors.

Let’s recap the 12 most effective solutions:

  1. Clear the web browser cache and cookies
  2. Disable VPN temporarily
  3. Disable CDN temporarily
  4. Scan for malware
  5. Restore the .htaccess file
  6. Reset the site’s file permissions
  7. Disable WordPress plugins
  8. Verify the A record
  9. Update nameservers
  10. Upload an index page
  11. Modify file ownership
  12. Use Hostinger AI Troubleshooter

Focusing on “403 Forbidden” error prevention is key. Conduct regular security audits, document access controls, and update web server software to avoid future errors.

Suggested Reading

Check out our website troubleshooting guide for best practices on diagnosing and fixing a broken website.

403 Forbidden error FAQs

Can incorrect file permissions cause a 403 error?

Yes. The website can block access to the requested resource when file permissions are misconfigured. This causes an authentication failure that prevents users from viewing or accessing specific files or directories. To fix the “403 Forbidden” error, it’s crucial to check the file permissions, rectify any discrepancies, and ensure the server configuration aligns with access requirements.

Can server misconfigurations cause a 403 error?

Yes. Misconfigured web server settings and files like .htaccess can restrict access to certain resources, resulting in a 403 Forbidden error.

Is it possible to customize the 403 error Page?

Yes. Website administrators can create custom error pages to display an informative message that aligns with the website’s branding. This custom page also lets an administrator provide specific instructions to resolve the 403 error.

Author
The author

Ariffud Muhammad

Ariffud is a Technical Content Writer with an educational background in Informatics. He has extensive expertise in Linux and VPS, authoring over 200 articles on server management and web development. Follow him on LinkedIn.

Author
The Co-author

Jordana Alexandrea

Jordana is a Senior Content Writer at Hostinger with a background in Information Systems. She has over five years of experience in WordPress and is casually dabbling with PHP and MySQL. Her passion for writing and technology drives her to create tutorials for anyone wanting to build their online presence. Follow her on LinkedIn.