How to Fix a 403 Forbidden Error on Your Website

A 403 Forbidden error means your server received the request but is deliberately refusing to show the page. It's different from a 404, where the page simply doesn't exist: with a 403, something on your hosting account is actively blocking access. Most of the time it comes down to one of a handful of causes, and you can usually find and fix it in a few minutes.

Common causes of a 403 error

• No index file in the folder, and directory listing is turned off.
• Incorrect file or folder permissions.
• A deny rule in your .htaccess file.
• Your IP address (or the visitor's) has been blocked.
• Hotlink protection or a ModSecurity rule is blocking the request.

Before troubleshooting further, clear your browser cache or try the page in a private/incognito window. Browsers sometimes cache an old 403 response even after the underlying issue is fixed.

1. Check for a missing index file

If a folder (including your site's root, public_html) doesn't contain an index.html or index.php file, and directory listing is disabled, the server has nothing to show and returns a 403 instead. Open File Manager, go to the folder in question, and confirm an index file exists with the exact name your site expects.

2. Fix file and folder permissions

Web servers expect specific permission levels: folders should generally be 755 and files 644. Anything more restrictive can trigger a 403.

In cPanel

1. Open File Manager from the cPanel dashboard.
2. Navigate to public_html (or the affected subfolder).
3. Right-click the folder or file and choose Change Permissions.
4. Set folders to 755 and files to 644, then click Change Permissions to save.

In DirectAdmin

1. Open File Manager from your DirectAdmin dashboard.
2. Browse to the affected folder or file.
3. Select it and click Change Permissions in the toolbar.
4. Set folders to 755 and files to 644, then confirm.

3. Check your .htaccess file

An .htaccess file in your site's root can contain rules that deny access to a file, folder, or visitor. Open it in File Manager (in either panel) and look for lines starting with Deny from or a Require directive that excludes your visitors. If you recently edited this file or installed a plugin/script that modified it, try renaming it temporarily (e.g. to .htaccess_old) and reloading the page. If that fixes it, restore the file and edit the offending rule instead of leaving it renamed.

4. Check for an IP block

If only certain visitors (or you) are seeing the 403, an IP address may have been blocked, sometimes automatically after repeated failed login attempts elsewhere on the account.

In cPanel

1. Open IP Blocker from the cPanel dashboard.
2. Check the list of blocked IP addresses.
3. Select the relevant entry and click Delete to remove the block.

In DirectAdmin

1. Open IP Access Control (sometimes labeled IP Deny Manager) from your DirectAdmin dashboard.
2. Look for the IP address under the deny list.
3. Select it and click Delete to remove the restriction.

5. Rule out hotlink protection or ModSecurity

If the 403 only shows up on certain images or file types, hotlink protection may be blocking direct requests from other sites. If it happens right after submitting a form or a specific page action, a ModSecurity rule may be the cause instead of a permissions or file issue. Both have their own dedicated fixes: see How to Fix a 403 Forbidden Error Caused by ModSecurity and How to Enable Hotlink Protection for Your Images if the steps above don't resolve it.

If you've worked through all of the above and the page is still returning a 403, reach out to ZIPROF support with the exact URL and the time you saw the error, so it can be traced in the server logs.