403 Forbidden on WordPress or wp-admin: Causes and a Safe Fix Order

On this page

1. Where the 403 appears tells you a lot
2. Step 1: confirm it is really a 403, and for whom
3. Step 2: check security plugins and login protection
4. Step 3: check Cloudflare, a CDN or your host's firewall
5. Step 4: regenerate .htaccess
6. Step 5: correct file and folder permissions
7. Step 6: check for a missing index file and directory browsing
8. Step 7: ask the host
9. 403 errors in WooCommerce and Elementor
10. What not to do while fixing a 403
11. How long does a fix take?
12. Preventing 403 errors
13. Quick check: find what is blocking you
14. When to get help
15. FAQs

A WordPress 403 forbidden error means the server received the request but refuses to serve it. On WordPress it is usually caused by a security plugin or firewall rule, a broken .htaccess file, wrong file permissions, or a block applied by your host or CDN to your IP address. The safe fix order is: note exactly where the 403 appears, check security plugins and firewalls, regenerate .htaccess, correct file permissions, and then ask the host to check their logs.

Below is how to narrow down the cause quickly without making the site less secure. If you would rather hand it over, a fix like this can be handled through my WordPress maintenance and support plans.

Where the 403 appears tells you a lot

Where you see 403	Most likely cause	Start with
Whole site, all visitors	.htaccess rule, folder permissions, host suspension	.htaccess and permissions
Only wp-admin or wp-login.php	Security plugin, login protection, firewall	Security plugin and firewall
Only for you or your office	Your IP blocked by a plugin, host or CDN	Try mobile data; check block lists
When saving a post or using Elementor	ModSecurity or WAF rule triggered by the content	Host or firewall logs
When uploading files	Permissions on the uploads folder or upload rules	wp-content/uploads permissions
One plugin's page or action	That plugin's capability check or a firewall rule	User role and plugin settings

Step 1: confirm it is really a 403, and for whom

Open the page in a private window, then on mobile data with Wi-Fi switched off. If it loads on mobile data but not at the office, your IP is probably blocked. Note the exact URL and the time, since your host will need both to find the log entry. Also check whether the error page looks like your host's, Cloudflare's or a security plugin's; each one points to a different place to fix it.

Step 2: check security plugins and login protection

Security plugins block IPs after failed logins, limit access to wp-admin by country or IP, and add firewall rules. If wp-admin returns 403:

1. If you can get into the dashboard from another connection, check the plugin's block list and whitelist your IP.
2. If you cannot log in anywhere, rename the security plugin's folder in wp-content/plugins using SFTP or the file manager. This deactivates it.
3. Try logging in again. If it works, reactivate the plugin and fix its settings rather than leaving it off.

Some plugins also write rules into .htaccess, which stay even after the plugin is deactivated. That is covered in the next step. If logging in fails for other reasons, WordPress login not working covers the other common causes, and securing your WordPress login shows how to protect it without locking yourself out.

Step 3: check Cloudflare, a CDN or your host's firewall

If your site uses Cloudflare or a hosting firewall, the 403 may come from there before WordPress even loads. Look at the security events or firewall log for your IP and the time of the error. Rules that block certain countries, bot-fight settings or a strict WAF rule set can catch real users, including you. Adjust or add an exception for the specific rule rather than switching protection off. Cloudflare for WordPress and WordPress firewalls explained go into this.

On many shared hosts, ModSecurity rules block requests that look like attacks. Saving a post that contains code samples, or using a page builder that sends large requests, can trigger them. Your host can see which rule fired and whitelist it for your site.

Step 4: regenerate .htaccess

A corrupted or overly strict .htaccess file is a common cause of a site-wide 403 on Apache and LiteSpeed servers.

1. Download a copy of .htaccess from the site root as a backup.
2. Rename it to .htaccess-old on the server.
3. Load the site. If the 403 is gone, the old file was the cause.
4. Log in, go to Settings, Permalinks and click Save to create a fresh default file.
5. Add back only the rules you need, such as caching or redirects, one at a time.

Look out for "deny from all" lines or rules added by malware. If the file contains rules you do not recognise, or it keeps changing back, the site may be compromised; see signs your WordPress site has been hacked.

Step 5: correct file and folder permissions

The web server needs permission to read your files. Typical safe values are 755 for folders and 644 for files, with wp-config.php often stricter. A folder set to 700 or a file set to 600, or files owned by the wrong user after a migration, can produce 403s. Do not use 777: it creates a security risk without fixing ownership. WordPress file permissions explained has the details, and your host can reset ownership if a migration left it wrong.

Step 6: check for a missing index file and directory browsing

If the 403 appears on a folder URL, the server may be refusing to list a directory that has no index file. That is normal and safe for folders like wp-content/uploads. If it happens on your home page, the index.php file in the root may be missing or renamed, sometimes after a failed update or a cleanup by a security scan.

Step 7: ask the host

If none of the above helps, contact your host with the URL, the time, your IP address and what you have already tried. They can check the server error log and firewall logs, which show the exact rule or reason. Also ask whether the account has been suspended or restricted, for example for resource use or malware. Hosting suspended for malware explains what to do if that is the reason.

403 errors in WooCommerce and Elementor

Two situations come up often. In WooCommerce, 403s on checkout or the admin orders screen are often a firewall or caching rule blocking AJAX requests to admin-ajax.php or the REST API. In Elementor, a 403 when saving or loading the editor usually means ModSecurity has blocked the request. In both cases, the host's or CDN's logs show which rule to relax for that path. Elementor stuck on loading covers the editor side.

What not to do while fixing a 403

• Do not delete the security plugin and forget it. Rename the folder to test, then reactivate and configure it properly.
• Do not switch off the firewall completely. Find the specific rule and add a narrow exception.
• Do not set everything to 777. It opens the site to tampering and usually does not fix an ownership problem anyway.
• Do not edit .htaccess without a backup. One wrong line can turn a 403 into a 500 error; see fixing the WordPress 500 internal server error if that happens.
• Do not ignore a 403 that only visitors see. If customers in one region or on one network are blocked, you may be losing enquiries without knowing.

How long does a fix take?

A blocked IP or a security plugin rule can often be cleared in minutes once you know where to look. A .htaccess or permissions issue is usually quick too. The slow cases are firewall rules on shared hosting, where you need the host to look up the log, and sites where the 403 is a side effect of malware. Keeping a record of the URL, time and IP from step 1 shortens every conversation with support.

Preventing 403 errors

• Whitelist your office IP in security plugins and your CDN.
• Keep one security plugin, not two that write competing rules.
• Back up .htaccess before installing plugins that change it.
• After migrations, check ownership and permissions straight away.
• Test logins and checkout after changing firewall settings.

The WordPress security checklist balances protection with access, so legitimate users are not blocked.

Quick check: find what is blocking you

1. Note whether the 403 hits every page, only wp-admin, or one action such as saving a post. That points to the source.
2. In your hosting panel, open the error log or the firewall/ModSecurity log and look for entries at the time of the error.
3. In the file manager, rename .htaccess to .htaccess-old and reload. If the site loads, regenerate it from Settings > Permalinks > Save Changes.

When to get help

Get help when the host firewall is blocking normal admin actions, when file permissions have been changed, or when the 403 appeared with other signs of a hack. WordPress maintenance and support covers server and permission fixes, and WordPress malware removal covers hacked sites. You can also send the details through the contact form.

FAQs

What causes a WordPress 403 forbidden error?

Most often a security plugin or firewall rule, a broken or strict .htaccess file, wrong file permissions or ownership, or your IP being blocked by the host or CDN.

How do I fix 403 forbidden on wp-admin?

Try another connection to check for an IP block, deactivate the security plugin by renaming its folder, check Cloudflare or host firewall logs, then regenerate .htaccess if needed.

Can a 403 error mean my site is hacked?

Sometimes. Malware can add rules to .htaccess or change permissions. If you find unfamiliar rules or the problem keeps returning, scan and clean the site.

Why do I get 403 only when saving in Elementor?

Usually ModSecurity or a firewall rule is blocking the save request. Ask your host to check which rule fired and whitelist it for your site.

Is it safe to set permissions to 777 to fix a 403?

No. It lets anyone on the server write to those files. Use 755 for folders and 644 for files, and fix ownership instead.