403 Forbidden error on your website: how to find the cause and fix it

A 403 Forbidden error means the server found the page but refuses to show it. On LJPc hosting the cause is almost always in your website or in the settings of your domain: a rule in .htaccess, a WP Toolkit or plugin security measure, file permissions, a missing index file or the PHP setting run PHP as. The error page and the Plesk log tell you which one it is, and in most cases you can fix it yourself.

Below you learn how to recognise a 403, where to find the cause and how to fix each cause. New to Plesk? Start with the Plesk control panel guide.

What does 403 Forbidden mean?

The server answers every request from your browser with a status code. A 403 means the server understands the request but will not give you access. That is different from a page that does not exist or a server that crashes. This table helps you tell the errors apart.

Where does the 403 come from? Check the error page first

The text on the error page shows who refuses access: the web server, a plugin in your website or a service in front of your website.

You can also check which web server your site uses in your browser. Press F12, open the Network tab, reload the page and click the top line. If Response Headers shows server: LiteSpeed, your site runs on LiteSpeed. With server: nginx it runs on Apache, with nginx in front.

Find the cause in the Plesk log

The log of your website shows which addresses returned a 403. On an Apache server it also shows why.

1. Open Plesk from the customer portal. See open Plesk from the customer portal for how it works.
2. Go to Websites & Domains and click the Dashboard tab in your domain's card.
3. Under Dev Tools, click Logs.
4. In the filter row, filter Code on 403. You now see only the requests that got a 403, with the blocked address in the Message column.
5. Not sure which line is yours? Click Start real-time updates and reload the page with the 403. The IP filter narrows the list to your own IP address.
6. Clear the Code filter, choose Apache error under All logs in the top right and search Message for denied.

On a LiteSpeed server the reason for a 403 usually does not appear in the log. The Code filter still shows the blocked address, and the address and time are often enough to find the cause below. Read more in how to view error logs in Plesk.

Common causes and how to fix them

Your whole site or every PHP file returns a 403

Do images and HTML pages load, while every PHP file returns a 403, including a file you uploaded a moment ago? And does a PHP file that does not exist return a 404? Then run PHP as is probably set to an FPM application while your site runs on a LiteSpeed server. On our LiteSpeed servers, PHP runs as FastCGI application. To fix it:

1. In Plesk, open your domain's Dashboard and click PHP under Dev Tools.
2. Check run PHP as. If it shows an option with FPM application, choose FastCGI application served by Apache.
3. Leave the PHP version as it is and click OK at the bottom.
4. Reload the PHP file.

On our Apache servers FPM application is the standard and works well. If your site returns a 403 on PHP files there, the cause is elsewhere: switch back to your previous choice and check the log. More about this page in how to change the PHP version in Plesk.

Your main domain or a folder returns a 403

A 403 on yourdomain.com or yourdomain.com/folder often means an index file is missing. The server does not show a folder without index.php or index.html, so nobody can browse the list of your files. In the Apache error log you recognise it by AH01276.

• Are your files in a subfolder, for example because your zip file contained a folder? Move them into httpdocs itself.
• Is your index.html or index.php gone? Restore it from the File Manager Recycle Bin or from a backup.

How to move and restore files is explained in how to use the Plesk File Manager.

One file or folder returns a 403 after uploading

If the web server is not allowed to read a file or folder, you get a 403. This mostly happens after uploading with a program that sets its own permissions. Set files to 644 and folders to 755; the Plesk File Manager guide shows how. Never use 777: it lets anyone change the file.

A rule in .htaccess denies access

An .htaccess file can deny visitors, IP addresses or file types. Look for rules such as Require all denied, Require not ip, Deny from all or a RewriteRule ending in [F]. An .htaccess in a parent folder also applies to every folder below it. A well-known example is the Drupal .htaccess: it denies PHP files in subfolders that are not part of Drupal, including an installer script you upload to a subfolder yourself.

1. Open File Manager and turn on Show system files and directories under More > View Options, so .htaccess becomes visible.
2. Download .htaccess to your computer as a backup.
3. Remove the rule that denies access and save the file.
4. Not sure which rule it is? Rename the file temporarily, for example to .htaccess-off, and test again. If it works, the cause is in that file. Give it its original name back straight away, because without .htaccess the links to your WordPress pages stop working, and change only that one rule.

How .htaccess works and how to deny IP addresses yourself is explained in set up .htaccess: redirects, security and more.

WordPress: a WP Toolkit security measure

WP Toolkit in Plesk has security measures that deny certain requests with a 403. They protect your site, so only turn off the measure you really need to.

Googlebot and Bingbot are not on the bot protection list, so Google and Bing keep crawling your site.

1. In Plesk, click WordPress in the left menu and find your site's card.
2. Click the message under Security, for example Critical security measures applied.
3. Select only the measure that causes the 403 and click Revert.
4. Test again. To turn the measure back on later, select it and click Secure.

Prefer to keep the measure? Put the file somewhere else instead. A PHP script does not belong in wp-content/uploads, for example.

A security plugin or Cloudflare blocks you

Security plugins such as Wordfence stop requests that look like an attack. Sometimes that hits a normal action, such as saving a page that contains code. Wordfence then shows A potentially unsafe operation has been detected in your request to this site.

• Are you an administrator and sure it is a false alarm? Tick I am certain this is a false positive. on that page, click Allowlist This Action and repeat your action.
• Other security plugins keep their own log in WordPress, showing what was blocked and why.
• Locked out of WordPress? Rename the plugin's folder in wp-content/plugins with File Manager, for example to pluginname-off. WordPress then deactivates the plugin. Rename the folder back once you are in again.

Is there a Cloudflare Ray ID at the bottom of the error page? Then Cloudflare blocks the request. Look up that Ray ID under Security Events in your Cloudflare account to see which rule blocked it.

Sudden 403 errors in many places, without any change on your side

Do you suddenly get a 403 on wp-admin or on many pages, and are there .htaccess files in folders where you never put them? Your site may be infected. Some malware places an .htaccess in many folders that denies PHP files, so only the attacker's own scripts keep working. See what to do in malware alert from LJPc.

Still stuck? Send us this

Create a support ticket in the customer portal and we will look into it for you. Include:

• the full address that returns the 403, for example https://yourdomain.com/contact.php;
• the date and time you saw the 403;
• your IP address at that moment, found as described in IP address blocked?;
• a screenshot of the error page;
• what changed right before, such as an upload, an update, a new plugin or a migration.

With the address, the time and your IP address we find the request in the server logs and work out what blocks it.