More fixes

WordPress shows "403 Forbidden"

"Forbidden. You don't have permission to access this resource." A 403 means something between the visitor and WordPress looked at the request and refused it on purpose. That something is not always the same thing: the web server, the host's firewall, a security plugin, Cloudflare, or a password lock on a folder. The fix depends entirely on which one said no, so the first job is finding out who it was. Below is a rebuilt example (not a real client), then how to tell the five apart and what fixes each.

Find out who said no (five minutes)

1. Read the page that refused you. A plain white page saying "Forbidden" (sometimes with "Apache", "LiteSpeed" or "nginx" at the bottom) comes from the web server. "Sorry, you have been blocked" with a "Cloudflare Ray ID" line comes from Cloudflare. "Access Denied - Sucuri Website Firewall" or a page with your host's logo comes from a firewall in front of the site. A styled page that names a plugin, such as "Your access to this site has been limited by the site owner" (Wordfence), comes from a security plugin.
2. Note where it happens. Every page, only /wp-admin and /wp-login.php, only when you press Save or Update, or only on images. Each points at a different cause in the table below.
3. Try from another network. Open the site on your phone with Wi-Fi switched off. If it works there, your own internet address is blocked, and the site itself is fine for customers.
4. Think back one step. A host move, a new security plugin, a changed password, a "hardening" tip pasted into a file, or a Cloudflare setting switched on the same day is usually the cause.

The fixes, by who refused

1. The web server, on every page. Three usual causes. First, the .htaccess file in the site's main folder: in the host's File Manager rename it to .htaccess-old and reload. If the site comes back, log in and press Save in Settings, Permalinks to write a clean one, then look in the old file for lines such as Deny from all, Require all denied or Require ip that a plugin or tutorial left. Second, the main folder has no index.php: after a host move the files are often sitting one folder too deep (for example public_html/site-backup/), and a server with no front page to show refuses with a 403. Move them up a level. Third, permissions: folders should be 755 and files 644 (wp-config.php may be 640 or 600). A folder at 700 or a file at 600 that the server must read gives a 403; ask the host to reset ownership if files were copied in as the wrong user.
2. A security plugin, on wp-admin or wp-login. Too many wrong passwords, a country block or a "hide login" setting can lock out the owner. Use the unlock link the plugin emails, if it offers one. If not, in File Manager rename the plugin's folder in wp-content/plugins (for example wordfence to wordfence-off), log in, rename it back, then remove your address from its block list and check what triggered it.
3. The host's firewall, when you save a post or submit a form. Hosts run a rule set (often called mod_security) that blocks requests that look like attacks, and a post containing code, a long link list or certain words can trip it. Send the host the page address, the exact time and your internet address; they can see which rule fired and allow it for your site. Do not paste SecFilterEngine Off into .htaccess from an old tutorial: modern servers do not accept it and some answer with a 500 error instead.
4. Cloudflare: "Sorry, you have been blocked". In the Cloudflare dashboard open Security, Events, and search for the Ray ID shown on the page. It names the rule that blocked the visit: a custom rule, a country block, Bot Fight Mode or a managed rule. Change or skip that rule for the address that should get through. If a customer sent the screenshot, their Ray ID finds their visit.
5. A password-protected folder. In cPanel, Directory Privacy (or "Password Protect Directories") can lock wp-admin. You normally see a password box first, and cancelling it gives a 403 or 401. Remove the lock or use its password.
6. Images only. Hotlink protection in the host panel or Cloudflare can refuse images when the request comes from an address it does not list, such as a www versus non-www mix-up. Add both versions of the domain to its allowed list.
7. Test: open the home page, a few inner pages, /wp-login.php and an image address, from your computer and from the phone on mobile data, and save one draft post.

What you see, what it means, what it needs

What not to do

• Do not set folders or files to 777 to "make it allowed". It lets anything on the server change your site, and many servers refuse to run files set that way, which gives you a new error.
• Do not delete a security plugin's folder to get in. Rename it, log in, rename it back, then fix the setting that locked you out.
• Do not switch the host's firewall off for the whole site because one post would not save. Have the one rule allowed.
• Do not keep retrying the login. Most lockouts lengthen with every failed attempt.

Most 403s are one of the first three rows and are fixed in minutes once you know who sent them. If the host, the plugin and Cloudflare each say it is not them, that is what the box below is for. Related: "too many redirects" and a login page that keeps reloading.