08Website know-how & errors

Fix error 403 Forbidden – access denied

403 Forbidden on your Nexthosting website? The most common causes – file permissions, .htaccess, a missing home page, security rules – and how to find them.

In short

With a 403, the server understood your request but refuses to carry it out. The cause is usually one of four: wrong file permissions, a block in the .htaccess, a missing home page, or a security rule that considers a harmless request dangerous. In that case support can help if you give them the time and the address.

What 403 means

Unlike 404 (page missing), the page is there. The server only refuses access. Technically, a 403 comes from three places: from the file permissions of the file system, from rules (.htaccess, server configuration), or from a security layer (WAF) in front of your site.

Find the cause

Where does the 403 occur?

On the whole websiteHome page, file permissions or .htaccess

Only for a certain file or folderFile permissions or protection rule

When saving, uploading or submitting a formSecurity rule (WAF)

Only in the WordPress admin areaPlugin, security rule or IP block

Only for me, others can get inYour own IP is blocked or a browser problem

Cause 1: No home page

When someone opens meinprojekt.de, the server looks in the main directory for a start file: index.php, index.html and similar. If it is missing and the display of folder contents is switched off, you get a 403.

Check via SFTP or in the file manager whether an index.php or index.html is in the right folder (Upload files via SFTP).
Is the site in a subfolder? Then the domain is pointed at the wrong folder or the files are in the wrong directory.
A freshly created website contains a placeholder page. Upload your files to the same place.

Cause 2: File permissions and owner

The web server must be allowed to read files. Usual values are:

Object	Recommendation
Files	`644`
Folders	`755`
Sensitive files (`wp-config.php`)	`600` or `640`

Do not blindly set permissions to 777. Everything on this is in File and folder permissions. The owner can also be wrong if files were created by a script or a restore under a different user. Support can correct that.

# Reset permissions via SSH (in the website directory)
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;

Cause 3: Rules in the .htaccess

An .htaccess can block access, for example:

Require all denied

or Deny from all. Check the file in the affected folder and in all folders above it, because .htaccess also applies to all subfolders. Test with a temporarily renamed file (.htaccess-old). A WordPress security plugin sometimes writes blocks into the file itself. More in .htaccess basics.

Cause 4: IP block or password protection

Password protection on a directory actually shows 401, but if set up wrongly it can also show 403.
A security plugin blocks your IP address after several failed attempts. Wait or unblock it in the plugin; via SFTP you can briefly switch the plugin off (rename its folder).
Country or IP blocks in a plugin or in .htaccess sometimes lock you out yourself. Switch networks (phone) and try again.

Cause 5: Security rule (WAF or ModSecurity)

Many web servers filter requests with a web application filter (WAF, often ModSecurity). It checks whether a request looks like an attack, for example an SQL injection. Rarely, it also reacts to harmless requests: a post with certain words, a plugin upload, a form with special characters. The result is a 403 even though file permissions and .htaccess are fine.

How to recognise it:

The 403 only occurs with certain actions (saving, uploading, searching) and reproducibly with a particular piece of content.
The error page looks different from usual, or the error log names a rule number.

What you can do:

Note the date and exact time (with seconds if possible), the complete address and what you did (e.g. “saving a post, the text contains …”).
Open a ticket and send these details: Support. Support can look in the logs to see which rule triggered, and adjust it for your website.
As a workaround, you can change the triggering content (shorten it, remove special characters).

How to understand such filters in everyday use is also covered under Website security.

Cause 6: Directory listing, hotlink protection and more

Show folder contents: If the display is switched off (Options -Indexes), a folder without a start file returns 403. This is intended and safe.
Hotlink protection: Prevents others from embedding your images. If set up wrongly, it also blocks you.
Protected files: Files such as .env, .git or backups are blocked on purpose.

403 for players?

This code belongs to websites. Game servers have different error messages. Help on that: Game server overview.

Frequently asked questions

Is 403 the same as 401?

No. With 401 a login is missing; with 403 there is no access, even if you are logged in.

The 403 appeared suddenly, I changed nothing.

Then something has often changed in the background: an update, a security plugin, a new rule. First check the .htaccess and the plugins, then contact support.

Can support always fix the 403?

If a security rule is the cause, they can check and adjust it. With file permissions and .htaccess it is usually faster if you try it yourself following the guide.