Seeing “403 Forbidden — You don’t have permission to access this resource” on your WordPress homepage or /wp-admin/ login screen means your web server understood the request, but security rules or Linux file permissions refused to serve the file.
Before changing random folders, you can visually verify the exact octal (`755` vs `644`) and symbolic (`-rwxr-xr-x`) permission codes using our Free Linux & cPanel chmod Permission Calculator.
Is Free Hosting Holding Your Website Back?
Free hosting is great for testing, but strict CPU, inode, and Entry Process limits can knock your site offline once Google starts indexing your pages. Run our 60-second check to see what your site actually needs:
Step 1: Reset WordPress File & Folder Permissions (`755` and `644`)
If you recently uploaded files via FTP or migrated hosts, wrong POSIX file permissions will immediately trigger a 403 error. Follow the golden rule for WordPress on cPanel:
- All Folders (`wp-admin`, `wp-content`, `wp-includes`, plugins, themes): Set to
755 - All Files (`index.php`, `.htaccess`, images, CSS/JS): Set to
644 - `wp-config.php`: Set to
640or600(Never `777`!)
In cPanel File Manager, right-click any folder or file, select Change Permissions, and enter 755 or 644. If you have SSH access, copy the one-line bulk reset command from our chmod Calculator.
Step 2: Regenerate a Clean `.htaccess` File
Security plugins often write overly aggressive IP blocks into your root .htaccess file. To test this:
- Open
public_htmlin cPanel File Manager (enable Show Hidden Files / dotfiles in Settings). - Rename
.htaccessto.htaccess_backupand test your website. - If your site loads, go to WordPress Dashboard → Settings → Permalinks and click Save Changes (or generate a clean file in our Free .htaccess Generator).
Step 3: Check ModSecurity & Hotlink Protection
If you only get a 403 error when saving posts with code snippets or JSON inside WordPress, your shared host’s ModSecurity Web Application Firewall (WAF) may be flagging a false positive. Check the Metrics → Errors log in cPanel or ask your host to whitelist the specific ModSecurity rule ID.
Frequently Asked Questions (FAQ)
What are the correct chmod file permissions for WordPress in cPanel?
All WordPress folders and directories should be set to 755 (drwxr-xr-x), all standard PHP, HTML, CSS, and image files should be set to 644 (-rw-r–r–), and wp-config.php can be set to 640 or 600.
Why does setting 777 permissions cause a 403 or 500 error on shared hosting?
Modern shared hosts running suPHP, CloudLinux, or LiteSpeed block scripts with 777 (world-writable) permissions as a security protection against malware injection.
Can a corrupted .htaccess file cause a 403 Forbidden error across my entire site?
Yes. Bad deny rules, hotlink protection mistakes, or security plugin lockouts inside .htaccess are the #1 cause of sudden 403 Forbidden errors in WordPress.