How to Fix 403 Forbidden Error in cPanel!

Have you opened your website only to see a 403 Forbidden error? This error can be frustrating because it prevents visitors from accessing a page or sometimes your entire website. The good news is that you can often fix it through cPanel without advanced technical knowledge.

A 403 Forbidden error means the web server understood the request but is refusing to allow access to the requested page or resource. Common causes include incorrect file permissions, a missing index file, a problem with the .htaccess file, security rules, or an IP address being blocked.

In this guide, we’ll explain what causes a 403 error and show you how to troubleshoot it step by step using cPanel.

What Is a 403 Forbidden Error?

A 403 Forbidden error is an HTTP status code that indicates the server is refusing access to a requested page or file.

Depending on your hosting configuration, you might see messages such as:

• 403 Forbidden
• HTTP Error 403
• You don’t have permission to access this resource
• Access to this resource on the server is denied

The exact message can vary by web server and hosting provider.

For example, if someone visits https://example.com/ and the server cannot serve the homepage because access is denied, the visitor may see a 403 error instead of the website.

A 403 error is different from a 404 error. A 404 means the requested resource could not be found, while a 403 means access to the resource is being denied.

Common Causes of a 403 Forbidden Error in cPanel

Before making changes, it helps to understand what might be causing the problem.

1. Incorrect file or folder permissions: Files and directories may have permissions that prevent the web server from reading them.

2. Missing index file: Your website’s document root may not contain a recognized homepage file, such as index.php or index.html, and directory listing may be disabled.

3. Incorrect .htaccess rules: A configuration rule may deny access to your website or a particular directory.

4. Security restrictions: A firewall, security plugin, ModSecurity rule, or hosting security system may block a legitimate request.

5. IP address restrictions: Your IP address may be blocked by an access rule or security feature.

6. Incorrect document root or file location: Your domain may point to a directory that does not contain the intended website files.

7. Ownership or server configuration problems: Some issues cannot be corrected from cPanel and require help from your hosting provider.

How to Fix a 403 Forbidden Error in cPanel

Try the following methods one at a time. After each change, reload your website in a private browser window to check whether the error is resolved.

Step 1: Check the File and Folder Permissions

Incorrect permissions are a common cause of 403 errors.

To check them:

1. Log in to your cPanel account.
2. Open File Manager.
3. Navigate to your website’s document root. For a primary domain, this is often public_html.
4. Locate your website files and folders.
5. Check the permissions displayed in File Manager.

Typical permissions for a standard PHP website are:

• Folders: 755
• Files: 644

For example, a folder may need permission 755, while a PHP file may use 644.

To change permissions:

1. Right-click the relevant file or folder.
2. Select Change Permissions.
3. Enter the appropriate permission value.
4. Save the changes.

Important: Do not change every file and folder blindly. Apply the correct permissions only where needed. Avoid setting permissions to 777, which grants broad access and can create security risks. If the correct permissions are already in place, investigate another possible cause.

Step 2: Check Whether an Index File Exists

When someone visits your domain, the server usually looks for a default homepage file, such as index.php or index.html.

If that file is missing, and directory browsing is disabled, the server may return a 403 error.

To check:

1. Open cPanel and go to File Manager.
2. Open your website’s document root, often public_html.
3. Look for index.php, index.html, or another homepage file supported by your hosting configuration.
4. Confirm that the file is in the correct directory and has readable permissions.

If you use WordPress, the main WordPress files—including index.php—should normally be present in the WordPress installation directory.

If the index file was accidentally deleted, restore it from a clean backup or reinstall the relevant application files safely. Do not create an empty index file as a substitute for a missing website homepage.

Step 3: Check the .htaccess File

The .htaccess file can control access and other server behavior on hosting environments that support Apache-style configuration. An incorrect rule can block visitors from your website.

Before editing it, make a backup of the existing file.

To test whether .htaccess is responsible:

1. Open File Manager in cPanel.
2. Open public_html or the directory where your website is installed.
3. Enable Show Hidden Files (dotfiles) in File Manager settings if you cannot see .htaccess.
4. Download the file or make a copy as a backup.
5. Rename .htaccess to something like .htaccess-backup-test.
6. Reload your website.

If the website starts working, the original .htaccess likely contains a problematic rule. Do not leave the file renamed permanently if your website depends on its rewrite rules.

For WordPress, you can regenerate the standard rewrite rules by logging in to the WordPress dashboard and going to Settings → Permalinks, then clicking Save Changes. This can create fresh WordPress rewrite rules when WordPress has permission to update the file.

If the problem remains, restore the original .htaccess file and investigate other causes. Custom redirects, access restrictions, and application-specific rules may need to be preserved.

Step 4: Confirm Your Domain’s Document Root

A domain can show a 403 error if it points to the wrong directory or to a directory without the correct website files.

To check:

1. Log in to cPanel.
2. Open Domains.
3. Find the affected domain.
4. Check its document root, if displayed.
5. Open that directory in File Manager.
6. Confirm that the correct website files are present.

For example, if your domain points to public_html/shop but your website files are stored in public_html/store, the domain may not display the intended website.

Do not move or delete files until you have confirmed the correct document root. If the domain’s configuration cannot be changed through your cPanel interface, contact your hosting provider.

Step 5: Check IP Blocks and Security Rules

Sometimes, the server blocks a request because of an IP restriction or a security rule.

If only you are seeing the error, try opening the website using a different network, such as mobile data. This can help determine whether the problem is related to your current IP address, although it does not prove the cause.

Next, check any relevant security features available in your cPanel account:

• IP Blocker, if available
• Password-protected directories
• Hotlink protection settings
• Security or firewall tools provided by your host

If your hosting provider offers ModSecurity controls, ask support whether a security rule is blocking the request. Do not disable security protections globally just to test the website. If a legitimate request is being blocked, the provider may be able to identify the specific rule and resolve the issue safely.

Step 6: Check Password-Protected Directories

cPanel allows you to protect directories with a username and password. If access protection was configured incorrectly, visitors may be unable to access the intended content.

To investigate:

1. Open cPanel.
2. Find Directory Privacy or the equivalent feature in your account.
3. Locate the directory that is returning the error.
4. Check whether password protection is enabled intentionally.
5. Review the directory’s access settings.

If the directory should be public, correct its settings carefully. If it contains private files, keep the protection enabled and verify that authorized users are accessing it correctly.

Step 7: Review Hotlink Protection

Hotlink protection helps prevent other websites from directly embedding your images or other supported resources. Incorrect settings can sometimes block legitimate requests.

If the 403 error affects images, downloads, or files embedded on another page:

1. Open cPanel.
2. Find Hotlink Protection, if available.
3. Review the protected file extensions and allowed domains.
4. Confirm that your own domain and any legitimate aliases are allowed.
5. Adjust the settings only if they are responsible for the problem.

Avoid turning off protection permanently unless you understand the consequences.

Step 8: Check WordPress Plugins and Security Settings

If your website uses WordPress, a security plugin or access-control setting may be responsible for the 403 error.

If you can access the WordPress dashboard:

1. Review recent changes to security plugins and access rules.
2. Check whether a plugin is restricting the affected page or your IP address.
3. Update the relevant plugin if an appropriate fix is available.
4. Test the website again after making one change at a time.

If you cannot access the dashboard, you may be able to test a plugin by renaming its folder through cPanel File Manager. However, this can affect website functionality, so make a backup first and avoid disabling security protections unnecessarily.

If disabling a plugin resolves the issue, restore normal operation and investigate that plugin’s settings before deciding whether to replace it.

Step 9: Review Error Logs

If the previous steps do not solve the problem, error logs may help identify the cause.

Depending on your hosting setup, you may find an Errors tool in cPanel or access to website error logs through File Manager. Some providers keep logs outside the directories available to customers.

Look for messages that occur at the same time as the 403 error. They may point to:

• A denied file or directory
• A permission problem
• An invalid configuration rule
• A security module blocking a request

If you are unsure how to interpret the logs, send the relevant timestamp and error message to your hosting provider. Remove passwords, tokens, and other sensitive information before sharing logs.

Step 10: Contact Your Hosting Provider

Some 403 errors are caused by server-level settings that you cannot change through cPanel.

Contact hosting support if:

• The file permissions appear correct.
• The index file is present.
• The .htaccess test does not resolve the issue.
• Your IP address or requests appear to be blocked.
• Error logs indicate a server-level restriction.
• The website still returns 403 after careful troubleshooting.

Include your domain, the affected URL, when the problem started, any recent changes, and relevant error messages. This helps the support team investigate the issue more efficiently.

If your website is hosted with AmarHost, contact the support team through the appropriate support channel available in your account.

How to Prevent 403 Forbidden Errors

You can reduce the likelihood of future 403 errors by following a few good hosting practices.

• Keep permissions appropriate: Use secure, application-compatible file and folder permissions.
• Back up before editing: Save copies of .htaccess and other configuration files before changing them.
• Update carefully: Test plugin, theme, and application changes when possible.
• Review security settings: Check access rules after changing firewall, hotlink, or directory-protection settings.
• Monitor errors: Investigate repeated access-denied messages rather than ignoring them.
• Use reliable hosting: Choose a hosting environment with appropriate security controls and support when you need help diagnosing server-side problems.

Frequently Asked Questions

1. What causes a 403 Forbidden error in cPanel?

Common causes include incorrect file permissions, a missing index file, faulty .htaccess rules, IP restrictions, security rules, or an incorrect document root.

2. Can I fix a 403 error without technical knowledge?

Many common causes can be checked through cPanel File Manager and other built-in tools. Start with simple checks, back up configuration files before editing them, and contact hosting support if the problem involves server-level settings.

3. What permissions should I use for website files?

For many standard PHP websites, directories commonly use 755 and files use 644. Your application or hosting provider may require different settings in some cases. Avoid using 777 as a general fix.

4. Will changing .htaccess fix a 403 error?

It may, if an incorrect rule in .htaccess is denying access. Back up the file first and test by temporarily renaming it. If there is no improvement, restore the original file.

5. Why does my homepage work, but one page shows a 403 error?

The affected page or directory may have different permissions, access restrictions, application rules, or security settings. Check the specific URL and its corresponding files or application configuration.

6. Is a 403 error a sign that my website has been hacked?

Not necessarily. Most 403 errors are related to access permissions or configuration. However, if the error appeared alongside unfamiliar files, unexpected redirects, or suspicious account activity, review your website security and contact your hosting provider.

7. How is a 403 error different from a 500 error?

A 403 error means the server is refusing access to a resource. A 500 Internal Server Error indicates that the server encountered an unexpected condition while processing the request.

Final Thoughts

A 403 Forbidden error can prevent visitors from accessing your website, but it does not always indicate a serious problem. In many cases, checking file permissions, confirming that an index file exists, reviewing .htaccess, and inspecting access restrictions will help you identify the cause.

Make one change at a time and test the website after each step. If the issue persists, your hosting provider can investigate server-level permissions, security rules, and error logs.

With careful troubleshooting and regular backups, you can resolve many common 403 errors and help keep your website accessible and secure.