How to fix the "403 Forbidden" error in 2024 (2024)

“403 Forbidden” is a standard HTTP status code indicating that the web server understands the request but refuses to authorize it. This could be due to permission issues, incorrect file permissions, or server configuration problems.

Here are potential causes that can trigger this error:

• Misconfigured file and folder permission settings. Prevents users from accessing sensitive files or certain parts of a website, often leading to a “403 Forbidden” error.
• Corrupt .htaccess file. Misconfiguration and malware can break the .htaccess code.
• Missing index page. The index.html or index.php file, which is the default homepage template, isn’t available in the website’s directory.
• Incompatible WordPress plugin. A WordPress plugin might be conflicting with another plugin or was incorrectly configured.
• Incorrect IP address. The domain name points to an inaccurate IP address whose website blocks your access.
• Malware scan. Your website’s security measures can limit access to specific resources to prevent malicious attacks.
• New web page link. The webpage link was recently updated, making it different from the cached version.
• Empty website directory. The URL is trying to access your website’s directory instead of a file.

Download comprehensive HTTP status codes cheat sheet

How to fix the “403 Forbidden” error

If you discover pages returning a “403 Forbidden error” either by using a website crawler or by simply noticing it, there’s no need to panic. Here are 12 effective ways to ensure that your website remains accessible and operates optimally.

These solutions will help you resolve and prevent potential downtime, keeping your site running smoothly.

1. Clear your browser cache and cookies

The browser cache speeds up website loading on future visits. However, if the web page’s link changes, it can cause a mismatch with the cached version and trigger the 403 HTTP status code. Browser cookies – small files that remember your preferences and details – are also a common culprit of the “403 Forbidden” error.

While cache is dedicated to improving website loading speed, cookies focus on personalizing your browsing experience. That’s why a forbidden page error usually occurs on a frequently logged-in website.

Keep in mind, that this method will force the browser to re-request site files, requiring you to sign in again on most websites.

Here are the steps to clear cache and cookies on Google Chrome. The steps are similar in Firefox and Safari:

1. Click on the three-dot icon in the top right corner and select Settings.
2. Locate Privacy and security → Clear browsing data.

3. Use the drop-down menu to choose the time range. We recommend choosing All time to remove all the old files. Then, select Cookies and other site data and Cached images and files.
4. Click Clear data to erase them.

After completing these steps, try revisiting and logging into the problematic website to see if it fixes the error. This method also works for other errors, like the 400 Bad Request.

2. Temporarily disable VPN

A virtual private network (VPN) can trigger a “403 Forbidden” error on websites that block access from VPN servers due to security or regional restrictions.

To test this theory, temporarily disconnect your VPN and retry accessing the web page. If this resolves the error code, consider switching to a different VPN server or contact your VPN provider.

3. Temporarily disable CDN

A content delivery network (CDN) is a network of servers that caches and delivers content from the closest web server to the user, reducing load times and bandwidth usage.

If your website uses a CDN, it may cache a “403 Forbidden” error due to issues like file permissions, IP blocking, and incorrect .htaccess rules. Temporarily bypassing CDN helps determine whether the source of the error is the original web server or the CDN itself.

We automatically enable our in-house CDN for our Business Web Hosting plan and above. Follow these steps to troubleshoot “403 Forbidden” by disabling Hostinger CDN temporarily:

1. Navigate to Performance → CDN from hPanel.
2. Find the CDN status section and click Disable.

3. If this fixes the issue, keep the CDN disabled for now and contact our support team for troubleshooting assistance.

4. Scan for malware

.htaccess is a web server configuration file that primarily works by altering the Apache web server settings. Located in your website’s root directory public_html, it contains a set of rules for how your website should behave in certain situations, including who can access what resources or pages.

If your WordPress site is infected with malware, unwanted code can be injected into the .htaccess file. Having the rules changed can cause the HTTP status code 403.

Hostinger users can leverage our built-in scanner to remove malware in WordPress. You don’t need to purchase third-party integrations because the automated tool can scan your websites for malware for free.

Here’s how to do it:

1. On hPanel, navigate to Security → Malware Scanner.
2. If no malware is found, this section will display your hosting plan’s name and the time since the last scan.
3. Otherwise, the malware scanner will summarize detected malicious files in the past 30 days and the actions taken to fix them.

For extra security, use a WordPress malware scanner plugin to identify malicious software on your WordPress website. The top WordPress security plugins, such as Sucuri and Wordfence, offer this feature.

If the error persists after fixing the infected file, we recommend creating a new .htaccess file.

5. Restore the .htaccess file

If your .htaccess file is infected or misconfigured, replace it using an FTP client or file manager.

For Hostinger users, follow these steps to locate and create a new .htaccess file. If you’re using cPanel, the steps should be similar:

1. On hPanel, navigate to Files → File Manager.
2. Open the public_html directory and locate the .htaccess file. Right-click on it and select Download to create a backup on your local computer.

3. Delete the current .htaccess file from your hosting account.
4. Create a new server configuration file by clicking New file and naming it .htaccess without any extensions.

5. Copy the following code to the new file, then Save it.

# Enable URL RewritingRewriteEngine On# Rewrite rule to redirect requests to index.phpRewriteCond %{REQUEST_FILENAME} !-fRewriteCond %{REQUEST_FILENAME} !-dRewriteRule ^(.*)$ index.php?/$1 [L]

Alternatively, follow these steps for WordPress websites:

1. Log in to your WordPress dashboard and select Settings → Permalinks.
2. Click the Save Changes button at the bottom without making any modifications. It will generate a new .htaccess file for your WordPress site.

Try to re-access the web address. If this method fixes the “403 Forbidden” error code, it indicates a corrupted .htaccess file.

6. Reset file and directory permissions

Websites have unique file permissions that control how users can read, write, and execute data. If misconfigured, it can cause HTTP 403 forbidden errors.

With Hostinger, you can fix file permission issues in just one click. To access the built-in tool on hPanel, look up Fix File Ownership in the search bar.

Select the confirmation checkbox and click Execute. The tool will automatically assign default permissions to all website files and folders.

Alternatively, configure an FTP client like FileZilla to reset file and folder permissions manually. Keep in mind that this method requires an understanding of FTP protocol and file permissions.

Here’s how to reset file permissions using FileZilla:

1. Make sure FileZilla is connected to your website.
2. Right-click on the public_html directory and select File Attributes.

3. In the Numeric value field, enter 755. This value allows only the owner to read, write, and execute the file or directory, preventing others from modifying it.

4. Select Apply to directories only, and click OK.
5. After changing directory permissions, repeat steps 2 and 3. This time, enter 644 in the Numeric value field and select Apply to files only. The 644 value allows the owner to read and write, while others can only read.

After applying the correct permissions, reaccess your website to check if the permission error persists.

7. Disable WordPress plugins

If the previous methods fail, check whether an incompatible or problematic WordPress plugin is causing the HTTP 403 error.

Hostinger users can disable their WordPress plugins straight from hPanel. Go to WordPress → Security and scroll down to the Installed plugins section. Then, click on the toggle to disable each plugin individually.

If you’d rather disable the plugins manually, use a file manager or an FTP client. Here’s how to do it via the hPanel file manager:

1. Navigate to the wp-content folder in public_html.
2. Locate the plugins folder and rename it to disabled-plugins. This will make the folder temporarily unrecognizable by the web server, deactivating all plugins simultaneously.

3. Now, try accessing your website. If HTTP error “403 Forbidden” is gone, a problematic plugin was likely causing the issue.
4. Revert the folder’s name to plugins to re-enable all plugins.
5. Go to Plugins → Installed Plugins from your WordPress dashboard and Deactivate all plugins one by one. Whenever you deactivate a plugin, check if it resolves the error. This step will help identify the faulty plugin.
6. Once identified, update or remove the plugin to fix the issue.

8. Verify the A record

The “403 Forbidden” error can occur if your domain points to an incorrect IP address, denying you access even with valid credentials. To prevent this, ensure your domain points to your hosting provider’s IP address.

Hostinger users can navigate to Plan Details on hPanel to find their website’s IP address.

Follow these steps to check if the domain A record is pointed correctly via hPanel:

1. From the hPanel dashboard, navigate to Advanced → DNS Zone Editor.
2. You will find a list of DNS records. Locate the A records by scanning the Type column.
3. Examine the IP addresses in the Content column.

4. If the A records don’t point to the correct IP address, click Edit to modify them. Once you’re done, click Update.

Editing an existing A record may affect any services or subdomains currently using it. If changing the existing A records doesn’t resolve the error or disrupt other operations, consider creating a new one.

On hPanel, you can create a new A record in the Manage DNS Records section. Select A as the Type and input the valid IP address in the Points to field. Then, click Add Record.

9. Update nameservers

If you’ve migrated to a new hosting provider and forgot to update your nameservers, your domain might still point to the old host and lead to a 403 error status code.

To resolve this issue, you must update your domain’s nameservers.

If you have recently migrated to Hostinger, here’s how to change your nameservers to Hostinger’s:

1. Go to Domains and select Manage next to your domain.

2. Click on the Change link in the Nameservers section.

3. Pick the Use Hostinger nameservers option and click Save.

10. Upload an Index page

The following methods are more technically complex. If you’re unsure of the steps, contact your hosting provider’s support team for troubleshooting assistance.

Most web servers disallow directory browsing for security reasons. Instead of showing what’s inside a folder on the page, they’ll show a standard web page.

Moreover, attempts to access a directory without a standard web page, usually in index.html or index.php format, result in a “403 Forbidden” error message.

First, check whether your website’s homepage name is index.html or index.php. If not, rename it in the FTP client or file manager.

Another way to resolve this issue is to upload an index page to your public_html directory and create a redirect to your existing homepage. Here’s how to do it:

1. Access the public_html directory using an FTP client or file manager.
2. Create a New File named index.html or index.php inside the root directory.
3. Open the .htaccess file in the root directory. Insert the following code snippet to redirect index.php or index.html to your existing homepage. Be sure to replace homepage.html with the actual name of your page.

Redirect /index.html /homepage.html

4. Save the changes, then check your website’s homepage to see if the problem is resolved.

Whichever method you choose, we strongly advise against enabling directory browsing to resolve the “403 Forbidden” error. This can expose your directory’s content to the public, leading to security risks.

11. Edit File Ownership

Incorrect file ownership can trigger the “403 Forbidden” error, particularly in Linux-based computers or VPS hosting. If you’re using a VPS with SSH access, you can modify file ownership by connecting your VPS to an SSH client like PuTTY.

After connecting to the SSH server, check the ownership using the following SSH command:

ls -l [file name]

The result will resemble the following:

-rwxrw-rw- 1 [owner][group] 22 Sep 22 10:00 filename.txt

Pay attention to the owner and group sections. The correct ownership should match your hosting account’s username. Otherwise, utilize the chown Linux command to adjust file ownership.

Here’s the basic syntax for the chown command:

chown [owner][:group] [file name]

For example, if your username is John, use the command below:

chown John filename.txt

12. Use Hostinger AI Troubleshooter

Although still in beta, Hostinger’s built-in AI Troubleshooter provides a practical solution to troubleshooting. Hostinger users can use it to fix the “403 Forbidden” error with a few clicks.

Here’s how to use Hostinger AI Troubleshooter:

1. On hPanel, navigate to WordPress → AI Troubleshooter (beta). You can check the Help page to see if it detects the “403 Forbidden” error on your website.

2. Click on the Fix with AI assistant button to see its troubleshooting recommendations.
3. Select Fix my website if you approve its corrective action. Otherwise, choose Try another solution so the AI will come up with another solution.

Learn how to fix the “403 Forbidden” error with Hostinger Academy

Watch this video if you need help visualizing the troubleshooting steps.

Conclusion

The “403 Forbidden” error can disrupt your website’s functionality and lead to a poor user experience. Multiple causes can trigger this HTTP error, including incorrect file permissions, a corrupted .htaccess file, faulty plugins, and IP blocking errors.

Let’s recap the 12 most effective solutions:

1. Clear the web browser cache and cookies
2. Disable VPN temporarily
3. Disable CDN temporarily
4. Scan for malware
5. Restore the .htaccess file
6. Reset the site’s file permissions
7. Disable WordPress plugins
8. Verify the A record
9. Update nameservers
10. Upload an index page
11. Modify file ownership
12. Use Hostinger AI Troubleshooter

Focusing on “403 Forbidden” error prevention is key. Conduct regular security audits, document access controls, and update web server software to avoid future errors.

403 Forbidden error FAQs