A 403 means the server understood the request but refuses to serve it. The cause is almost always permissions, an .htaccess rule, or a missing index file. Here is how to fix it.
Quick answer
A 403 Forbidden means the server refuses to serve the page. Reset permissions to 755 for folders and 644 for files with the right owner, look for a deny rule in .htaccess, and make sure the folder has an index file (index.php or index.html), because directory listing is usually disabled.
Cause 1: wrong file/folder permissions
Files the web server can't read return a 403. Reset web permissions — folders 755, files 644:
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;Cause 2: an .htaccess rule
A Deny/Require rule or a broken rewrite blocks access. Rename .htaccess to test; if the 403 clears, the rule was the cause — regenerate a clean one.
Cause 3: no index file
If a folder has no index.html/index.php and directory listing is off, the server returns 403 instead of showing the files. Add an index file (or enable listing if you intend to show it).
Cause 4: an IP / security block
A firewall, ModSecurity rule or an IP deny-list can 403 specific visitors. Check the server's error log — it names the rule or IP that triggered the block.
The web server error log says exactly why a 403 happened — a permission, a rewrite, ModSecurity, or an IP rule. Read it before guessing.
403 = refused, not missing. Check permissions (755/644), test .htaccess, add an index file, and read the error log.
Cause 5: ownership mismatch on shared hosting
If files were uploaded via SSH/root and end up owned by a different user than the one PHP-FPM/the web server runs as, that mismatch alone can trigger 403 even with seemingly correct permission numbers. Check ownership with ls -l as well as the mode bits, and chown files to the correct hosting user.
Cause 6: a WAF or CDN rule (e.g. Cloudflare)
A security rule at Cloudflare or another CDN/WAF layer can 403 a request before it even reaches your server. If the error page doesn't look like your server's normal 403 page, check the CDN/WAF dashboard for a firewall event log first.
How to prevent 403 errors
- Set permissions correctly at upload/deploy time (755 dirs, 644 files) rather than fixing them after the fact.
- Keep an untouched backup of a known-good .htaccess.
- Always leave an index file in public folders, or explicitly enable directory listing if that's intended.
- Review WAF/ModSecurity rule changes before rolling them out broadly.
Related errors
If permissions are the real issue at the OS level, not just the web server, see permission denied on Linux. A 403 that keeps bouncing between pages is usually really a redirect loop, not a permissions problem. For a fatal application error instead of a block, see 500 Internal Server Error.