Forbidden (403): You don't have permission to access / on this server

Getting the message below on your website? In this article you'll read what usually causes it and how to fix it, including if you use WordPress.

Forbidden. You don't have permission to access / on this server.

The most common cause: no index file

Usually there is no index file in the folder you're requesting. When you request www.yourdomain.nl, the server looks in domains/yourdomain.nl/public_html for an index.php or index.html. If it isn't there, or your website is in a different folder, you'll get this message. Check it in File Manager.

Other causes

• A rule in your .htaccess file is blocking access, for example Deny from all.
• The permissions on a folder or file are too strict. Folders should be set to 755 and files to 644. Never set anything to 777 to fix an error: it doesn't solve anything and leaves your site vulnerable.
• The Web Application Firewall or Imunify360 blocked a request because it looked like an attack.

A 403 on your WordPress site

Getting the 403 in WordPress, for example after an update, when saving or in the admin area? Then go through these steps.

1. Disable your security plugin. Plugins such as Wordfence, iThemes Security or All In One WP Security have their own firewall. If you can no longer get into WordPress, use File Manager to rename the plugin's folder in wp-content/plugins, for example wordfence to wordfence-off. WordPress will then disable the plugin. If your site works again, check the plugin's settings or logs to see what it was blocking, and then give the folder its original name back.
2. Restore the default WordPress .htaccess. First save a copy of your current .htaccess in public_html. Then replace its contents with:

   # BEGIN WordPress
   <IfModule mod_rewrite.c>
   RewriteEngine On
   RewriteBase /
   RewriteRule ^index\.php$ - [L]
   RewriteCond %{REQUEST_FILENAME} !-f
   RewriteCond %{REQUEST_FILENAME} !-d
   RewriteRule . /index.php [L]
   </IfModule>
   # END WordPress

   If it works after that, the error was in one of the other rules. Add them back one at a time to find out which one it is.
3. Check the permissions. Folders at 755, files at 644. wp-content/uploads also needs to be writable for your website. See File and folder permissions (chmod).
4. Check the error log. In DirectAdmin, open Site Summary / Statistics / Logs and view your domain's error log around the time of the error. If you see a line with ModSecurity: Access denied with code 403 or IM360 WAF, the firewall is blocking the request. See Site summary and logs.
5. Disable a firewall rule. If you only get the 403 when saving or uploading, you can disable just the rule causing the problem in Web Application Firewall. Never turn off the firewall completely. If it's an Imunify360 message, send us the rule and the address of the page. See Imunify360: scanning your website for malware.

Can't figure it out? Send us a ticket with the time it went wrong, the address of the page and what you were trying to do. We'll look into it for you.

See also in the DirectAdmin manual: Showing and editing hidden files such as .htaccess.

Detailed explanation: Error 403 or 406 when saving or uploading in the DirectAdmin manual.

Have a VPS? Then take the free VPS and Linux server management course, lesson 3.1 Users, groups and file permissions.