A 403 Forbidden error means the server understood the request but refuses to show the page. Unlike a 500 error, nothing crashed; something is deliberately blocking access. On cPanel hosting it is usually a missing index file, permissions, an .htaccess rule or a security block.
Before you start
- Note whether the 403 appears on the whole site, one folder, or only for you. Ask someone else, or test from mobile data, to find out.
- Open cPanel → Metrics → Errors: the log line usually names the cause. See read the error log.
Missing index file
If a folder has no index.php or index.html, and directory listing is off, the server returns 403. Log message: Directory index forbidden by Options directive.
- Upload your site files into the correct document root (check it in cPanel → Domains).
- Make sure the home page is named exactly
index.htmlorindex.php(lowercase). - Brand-new addon domains and subdomains show 403 until you upload something.
Wrong permissions
Log message: Permission denied or because search permissions are missing.
- Folders need
755, files644. Thepublic_htmlfolder itself is normally750; do not change it. - Fix them in File Manager → Permissions, or in bulk with Terminal. See correct file permissions.
.htaccess rules
Log message: client denied by server configuration.
- Look for
Deny from all,Require all deniedorRequire iplines in.htaccessin the folder or any parent folder. - Security plugins often add such rules; disable or adjust them.
- Temporarily rename
.htaccessto test.
cPanel security tools
| Tool | Check |
|---|---|
| IP Blocker | Your IP or range is in the blocked list |
| Hotlink Protection | Images return 403 because a domain is missing from the allow list |
| Directory Privacy | A cancelled login prompt can end in 401/403 |
| ModSecurity | Log shows ModSecurity: Access denied ... [id "..."] |
ModSecurity blocks
The web application firewall blocks requests that look like attacks. False positives happen when saving a page with unusual code, uploading certain files, or submitting forms with SQL-like text.
- Note the rule id from the Errors log and the URL.
- Open a support ticket with both; we can whitelist the rule for your site.
- Do not turn ModSecurity off for the whole domain except briefly for testing (cPanel → Security → ModSecurity), as it protects you from real attacks.
Note: If every site and cPanel itself are blocked only for you, the server firewall probably blocked your IP after failed logins. Send us the IP from the IP checker.