WordPress 403 Forbidden Error: Causes and How to Fix It

A 403 Forbidden error means the server understood the request but refuses to show the page. On WordPress it can hit the whole site, a single page, or only wp-admin.

It matters for SEO too. If Google gets a 403, it cannot read the page, and the page can drop out of search.

The 6 Usual Causes

• A broken or corrupted .htaccess file.
• Wrong file or folder permissions.
• A security plugin blocking your IP address or a URL pattern.
• A firewall at your host or CDN, such as ModSecurity or Cloudflare rules.
• A missing index file after a migration.
• Your IP or country blocked by a security setting.

How to Fix It, in Order

• Rename .htaccess in your site's root folder to .htaccess-old, then go to Settings, Permalinks and click Save to create a fresh one.
• Check permissions with your host's file manager: folders should be 755 and files 644, with wp-config.php stricter, often 640 or 600.
• Deactivate your security plugin by renaming its folder in wp-content/plugins. If the error clears, adjust its blocking rules.
• Check Cloudflare or your CDN's firewall events for blocked requests.
• Ask your host to check their firewall logs for the blocked URL. Hosts can see ModSecurity blocks that you cannot.
• After a migration, confirm index.php exists in the root folder.

403 Only on wp-admin

If only the dashboard is blocked, the cause is almost always a security plugin, a login protection rule, or an IP restriction in .htaccess. Start with those.

Frequently Asked Questions

Is a 403 the same as a 404? No. A 404 means the page does not exist. A 403 means it exists but access is refused.

Can Google see a 403 I cannot see? Yes. Firewalls sometimes block crawlers but not people. Check URL Inspection in Search Console to see what Google gets.

Will a 403 hurt my rankings? If it lasts, yes. Google cannot index pages it is refused.

What permissions should WordPress use? 755 for folders and 644 for files is the common standard.

Want It Watched for You

Firewalls and security plugins can quietly block Google from your pages. Our SEO service checks what Google sees every week and fixes blocks before they cost you rankings.