Choose the next check from the evidence
If the refusal happens during a purchase, follow the WooCommerce Cloudflare checkout 403 guide to connect the failed request to the security event and order.
Check whether the refused page should be accessible
Copy the full page address and error text, plus the time and any request or Ray ID shown. Compare the homepage, the affected public page and your normal dashboard address. A denied directory listing or private configuration file is not a fault to fix. Work only on pages and actions you are authorised to access.
For a dashboard action, confirm that you are signed in with the intended account. Open a fresh login tab and try the action again after saving any unsaved text separately. Ask an existing administrator to verify your role using the user-role guide. Do not grant administrator access simply to make an error disappear.
If the problem occurs only on one network, record whether a mobile-data connection can load the same public page. This comparison helps support find an address-based block; it does not prove the original block was incorrect.
Trace a firewall refusal
A firewall checks incoming requests against security rules. Cloudflare and hosting firewalls operate outside WordPress, so deactivating a WordPress plugin cannot turn those rules off. Use the error's branding and request ID as clues, then confirm the source in the relevant security log.
If you manage Cloudflare, open the site's security events and filter by the recorded time, address and Ray ID. For a hosting firewall, send the same details to support and ask which rule blocked the request. In a WordPress security plugin, use its documented blocked-request or activity screen if the dashboard remains available.
For a confirmed false positive, ask the provider to adjust the specific rule for the required action. Retest once and confirm protection remains enabled. Avoid a sitewide bypass or an exception covering every request to wp-admin or admin-ajax.php. Those addresses handle sensitive operations too.
Investigate file access after a migration or permission change
If the hosting error log says permission denied for a file or directory, take a backup and ask the host to confirm its expected owner and permissions. The file owner and its permission settings both affect access; changing numbers alone does not correct ownership.
Use our file-permission guide for a recorded, targeted correction through File Manager. Do not apply 777 or make the whole installation writable. When the log points to a directory without an index file, ask the host to verify that the domain points at the intended WordPress directory and that its files were copied completely.
An access rule in .htaccess can also refuse a request on servers that use that file. Have the host identify the matching rule and restore its known working version if a recent edit caused the problem. Deleting the entire file can remove unrelated restrictions and redirects.
Test a suspected plugin without exposing the site
Use a staging copy when the error began after a plugin change and the host has ruled out its own firewall. Follow the plugin conflict procedure, keeping the plugin responsible for the tested feature active.
If a security plugin has locked you out, use its official recovery procedure or ask its support team to remove the confirmed lockout. A developer can use targeted file-based deactivation if necessary, with a plan to restore protection immediately. Do not leave the security plugin disabled as the permanent fix.
Confirm access and protection together
Repeat the original action from the affected account and network. Check the public page while logged out and confirm private pages still require the intended login. Inspect any recorded event for the retry, but judge success by the completed action and retained protections. An allowed request does not necessarily appear in a security-event list; an absent entry alone proves nothing.
Remove temporary exceptions that did not resolve the issue and record the final rule or permission correction. If access still fails, send support the new request time and ID so they can trace the remaining block rather than widening access further.
Cloudflare's Security Events instructions explain where to find the events and apply filters in its current dashboard.
Reference material
Cloudflare documents 403 responses. WordPress explains file ownership and permissions. Follow your provider's current controls for the specific rule it identifies.
Get help with the next step
If a firewall keeps blocking editing or checkout, ask BugShield for help with the 403 error. Share the failed action and request ID so we can assess how to restore legitimate access while retaining protection.