403 Forbidden on Web Hosting

A 403 Forbidden error means the server received your request just fine, but refused to fulfill it. On Web Hosting, this almost always comes down to one of three things: a missing index file, incorrect file permissions, or a security system stepping in.

1. Missing index file

By default, web servers won't let visitors browse a directory's contents if there's no index file to serve. The usual suspects are index.html, index.htm, and index.php.

Fix:

• Create a blank index.html (or index.php) in your site's root folder (public_html).
• If you're running a CMS, make sure index.php is present in the root and readable by the server.

2. Incorrect file or folder permissions

Web Hosting environments expect a specific permission structure. If something's off, you'll hit a 403.

The correct permissions are:

• Files — 644
• Folders — 755

Fix:
Open the cPanel File Manager (or connect via FTP) and set the correct permissions on your site's root directory and everything inside it.

3. Directory listing is disabled

If you intentionally want visitors to be able to browse a folder's contents (without an index file), add the following to your .htaccess file:

Options +Indexes

Keep in mind this exposes the folder's contents publicly, so use it with care.

4. ImunifyAV quarantine

Your hosting's security system may have automatically quarantined files it flagged as suspicious — and missing files mean a 403.

Fix:

1. Log in to cPanel → ImunifyAV.
2. Check for any quarantined files belonging to your site.
3. Either restore them from quarantine or add them to the exceptions list if you're confident they're clean.

A few extra tips

• After changing permissions or editing .htaccess, always clear your browser cache (Ctrl + F5) before checking the result.
• On WordPress, pay special attention to the wp-content/uploads folder — it should be set to 755.
• A 403 can also be triggered by a bad rule in .htaccess itself, such as a broken redirect or an IP block that's catching more than it should.