What this problem looks like
403 errors on WordPress usually come from wrong file permissions, aggressive security plugins, mod_security rules, or IP blocks in .htaccess. Unlike 500 errors, the server is actively refusing access rather than crashing.
Start by noting whether wp-login.php, wp-admin, or the whole site is blocked. Path-specific 403 often points at a security plugin or hotlink protection rule.
Step 1: Map where the 403 appears
Open the homepage, a blog post, wp-login.php, and wp-admin in a private browser window. If only wp-admin is blocked, a security plugin or host WAF is the likely cause.
- Sitewide 403: check root .htaccess and folder permissions.
- wp-admin only: security plugin or host admin protection.
- Uploads folder 403: hotlink protection or wrong permissions on wp-content/uploads.
Step 2: Fix file permissions on Linux hosting
Directories should be 755 and files 644. Never set 777 on production. In cPanel File Manager, select wp-content, wp-admin, and wp-includes and apply correct permissions recursively.
find /path/to/wordpress -type d -exec chmod 755 {} \;
find /path/to/wordpress -type f -exec chmod 644 {} \;Step 3: Inspect .htaccess for deny rules
Open .htaccess in the site root. Look for Deny from all, Require all denied, or plugin-generated blocks. Comment out suspicious sections and test.
Step 4: Deactivate security plugins via FTP
Plugins like Wordfence, iThemes Security, and All In One WP Security can 403 wp-admin after misconfiguration. Rename the plugin folder in wp-content/plugins/ to deactivate it without admin access.
- Rename wordfence to wordfence.off.
- Reload wp-admin.
- Reconfigure or replace the plugin before reactivating.
Step 5: Contact host about mod_security
If 403 appears when saving posts or uploading files, mod_security may flag legitimate requests. Ask your host to check mod_security logs and whitelist the rule ID blocking your action.
When to stop DIY and hire help
Persistent 403 errors after permission fixes often involve host WAF rules or corrupted .htaccess from multiple security plugins. BugShield resolves access blocks at a fixed price with secure Vault access to your hosting.