How to fix the WordPress 403 Forbidden error

Short answer

A WordPress 403 Forbidden error shows up when your server refuses access to a specific page or file, the decision is made by Apache/Nginx or a security layer in front of it, not by WordPress itself. The most common causes are a corrupted .htaccess file,

incorrect file or folder permissions, a conflicting plugin, or an overly strict firewall rule.. Rather than deleting files in a panic, figure out the error’s scope first, the whole site or just one page, since that tells you which step to try first. The order below moves from the most common cause to the rarest.

Why does WordPress show a 403 Forbidden error?

The error always looks the same (a short “403 Forbidden” message in the browser), but the cause can come from a few different layers:

• A corrupted .htaccess file, or one containing a bad rule
• File and folder permissions that became too restrictive after a backup restore or a server migration
• A security or caching plugin that mistakenly applies its own access rule to your own IP address or to every visitor
• A theme conflicting with directory-listing restrictions
• A firewall in front of the server (a CDN or ModSecurity) treating the request as suspicious and blocking it

What they share is that the problem sits in the layers a request passes through before it ever reaches WordPress’s database or content, not in WordPress itself.

Where does the error show up: the whole site or one page?

Before you start fixing it, pin down the scope. If the error only appears on one specific page, a media file or something under /wp-admin/, the cause is usually a permission or rule limited to that folder. If it shows up across the entire site, the root .htaccess file or a site-wide firewall rule is the more likely cause.

This distinction matters because in the second case you may not even be able to log into the WordPress dashboard, so some of the checks below have to be done through FTP or your host’s file manager instead.

Rebuild the .htaccess file

The most common cause is a corrupted or outdated version of the .htaccess file in your site’s root directory. Using FTP or your host’s file manager, go to the root directory, rename the existing .htaccess file as a backup instead of deleting it outright, then remove the active one.

Next, log into the WordPress dashboard and go to Settings → Permalinks, then click “Save Changes” without changing anything; WordPress regenerates the file automatically with its default rules. If you can’t log in, you can add the standard WordPress rule block by hand instead:

# BEGIN WordPress
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
# END WordPress

Check file and folder permissions

If rebuilding .htaccess didn’t fix it, file and folder permissions are next. A backup restore, a server migration, or some backup tools writing files with the wrong permissions can restrict the server’s own access to its files. Check permissions through your hosting panel’s file manager or an FTP client; the general rule is 755 for folders and 644 for files. Sensitive files like wp-config.php can use a tighter value (600 or 640), but setting everything else to something as loose as 777, even if it makes the 403 error disappear, opens the server up to a real security risk.

Deactivate plugins one by one to find a conflict

If .htaccess and permissions both check out, a plugin conflict is the next likely cause. Security, caching, and IP-blocking plugins in particular sometimes apply their own access rule too broadly by mistake. If you can reach the dashboard, deactivate every plugin at once and see if the error disappears; if it does, reactivate them one at a time to find the one responsible. If you can’t log in, do the same thing through FTP by temporarily renaming plugin folders inside wp-content/plugins one at a time.

Check a security plugin’s IP block list

If you’ve traced the conflict to a security plugin, look at its own settings panel for an IP blocklist or access restriction list. Many security plugins automatically add an IP address to a blocklist after repeated failed login attempts, and it’s fairly common for your own address to end up there by mistake. Removing it from the list usually resolves the error immediately.

Could a theme be causing the 403 Forbidden error?

Less common, but real: a theme with custom code that tries to block directory listing or restrict access to certain file types can trigger this error too. Temporarily switch to a default WordPress theme (like Twenty Twenty-Four) and check whether the error persists. If it disappears, you’ll need to reach out to your theme’s developer or the agency that built it.

A CDN or server firewall can also cause a 403

If your site sits behind a CDN or a firewall, Cloudflare, or a ModSecurity rule running on the server itself, that layer can reject the request before it ever reaches WordPress. None of the steps above will help in this case, because the problem is outside your WordPress install entirely. Check your CDN’s security events or blocked-request log; if your own IP address or a specific page request shows up as blocked there, you’ll need to loosen the rule or add an exception.

Is “Sorry, you are not allowed to access this page” the same as a 403 Forbidden error?

No, the two come from different layers. “403 Forbidden” happens at the server level, before WordPress even loads. “Sorry, you are not allowed to access this page” is generated by WordPress itself, usually when a logged-in user’s role doesn’t have permission for that action, for example, an author trying to edit someone else’s post. If you’re seeing this second message, the fix isn’t .htaccess or permissions, it’s checking the user’s role and capabilities.

What if nothing works?

If you’ve worked through every step above and the WordPress 403 Forbidden error is still there, the cause is most likely something server-side that you can’t see from your own panel: a server-wide ModSecurity rule, an IP reputation list, or the host’s own security policy. At that point, the fastest path is sharing exactly which steps you’ve tried and which URLs trigger the error with your hosting support team, their access to the server logs can surface the exact cause you can’t see.

Avoiding the 403 Forbidden error next time

Most of this is preventable. Add file-permission checks to your checklist for any site migration or backup restore; review your security plugin’s IP blocklist regularly; and test theme and plugin updates in a staging environment first. As our guide to the WordPress white screen of death also shows, most WordPress access issues trace back to the same three sources: file integrity, server resources, and configuration. If the cause turns out to be a security breach, or your site was compromised before, our guide to fixing a hacked WordPress site covers the cleanup and hardening steps separately.

If you want to see how WordPress generates its own .htaccess and permalink rules, WordPress’s official wp-admin/includes/misc.php source code is the mechanism behind it, the save_mod_rewrite_rules() function is exactly what builds that file.

Next step

A WordPress 403 Forbidden error looks alarming, but it’s usually an access problem resolved by rebuilding .htaccess or fixing file permissions, with no risk of data loss. If the problem keeps recurring server-side, or you want a broader review of your hosting setup’s security layers, our group company Web Tasarım Ofisi supports WordPress maintenance and technical troubleshooting.

To talk through your site’s technical setup or a custom software need, take a look at our custom software service or get in touch with Argo Ajans.