What this problem looks like
A 403 error on WordPress usually comes from wrong file permissions, aggressive security plugins, mod_security rules, or IP blocks in .htaccess. Unlike a 500 error, the server is actively refusing access rather than crashing.
Start by noting whether wp-login.php, wp-admin, or the whole site is blocked. A path-specific 403 error often points at a security plugin or hotlink protection rule.
Step 1: Map where the 403 appears
Open the homepage, a blog post, wp-login.php, and wp-admin in a private browser window. If only wp-admin is blocked, a security plugin or host firewall is the likely cause.
- Sitewide 403: check the root
.htaccessfile and folder permissions. wp-adminonly: security plugin or host admin protection.- Uploads folder 403: hotlink protection or wrong permissions on
wp-content/uploads.
Step 2: Fix file permissions on Linux hosting
Directories should be 755 and files 644. Never set 777 on a live site.
On shared hosting, use File Manager in cPanel, Plesk, or Site Tools. Select wp-content, wp-admin, and wp-includes, then change permissions recursively to 755 for folders and 644 for files. The exact control is usually labelled Permissions or Change Permissions.
Only run the commands below if you have SSH access to the server. They will not work inside File Manager.
find /path/to/wordpress -type d -exec chmod 755 {} \;
find /path/to/wordpress -type f -exec chmod 644 {} \;Step 3: Inspect .htaccess for deny rules
Find .htaccess in your site root, next to wp-admin and wp-content. Look for Deny from all, Require all denied, or plugin-generated blocks. Comment out suspicious sections and reload the site.
Step 4: Deactivate security plugins via FTP
Plugins like Wordfence, iThemes Security, and All In One WP Security can return a 403 error on wp-admin after a misconfiguration. Rename that plugin folder in wp-content/plugins/ via File Manager, SFTP, or FTP to deactivate it without admin access.
- Rename
wordfencetowordfence.off(or the matching folder name for your security plugin). - Reload
wp-admin. - Reconfigure or replace the plugin before renaming the folder back and reactivating.
Step 5: Contact host about mod_security
If a 403 error appears when saving posts or uploading files, mod_security may flag legitimate requests. Ask your host to check the mod_security logs and whitelist the rule ID blocking your action.
When to stop DIY and hire help
Persistent 403 errors after permission fixes often involve host firewall rules or a corrupted .htaccess file from multiple security plugins. BugShield resolves access blocks at a confirmed price without hourly billing surprises.