The 403 Forbidden error: why it appears and how to fix it

What you'll achieve

• find out why your website shows a 403 error;
• fix it from Enhance, without waiting for us;
• know what to send us if it is none of the causes below.

Before you start

• Log in to Enhance at https://server.nbt-host.com (see How to log in to Enhance and Webmail).
• Note exactly which address shows the error: the whole website, a single page, or only /wp-admin?
• The Enhance names are in English, exactly as they appear on screen.

The steps

1. The website folder is empty (new account or new website)

This is cause number one: for a new account, or a website added with “Add website”, public_html is empty until you upload the website or install WordPress, and the server responds with 403.

1. “Websites” » the website » the “Files” tab » the public_html folder.
2. If it is empty (or only has .htaccess, .user.ini, cgi-bin), upload the website (see Uploading a website with File Manager) or install WordPress from the “Apps” tab (see Installing WordPress from Enhance).

2. The home page isn't directly in public_html

The server looks in public_html for a file named index.html or index.php. If you extracted it into a subfolder (for example public_html/site/), you get a 403 or a list of files (“Index of /”).

1. In “Files”, open the subfolder, check “Select all”, right-click a file » “Cut”.
2. Go back to public_html, right-click an empty area » “Paste”.
3. Check the letter case: Index.html is not the same as index.html. The server tells them apart.

For a subdomain, the files are in its own folder (for example blog.domeniul-tau.ro, next to public_html), not in public_html (see Subdomains and additional domains in Enhance).

3. Wrong permissions

Files should usually have 644 and folders 755. A folder with 700 or a file with 600 can't be read by the server.

1. In “Files”, right-click the file or folder » “Get info”: you see the permissions.
2. Change them with right-click » “Permissions (CHMOD)”. For a folder, check “Apply recursively” if you want it to apply to its contents too.

Never set 777: it is a security risk and doesn't fix a 403.

4. A rule in .htaccess

An .htaccess brought over from another host or written by a security plugin can block entire addresses (Deny from all, Require all denied) or certain IPs.

1. In “Files” » public_html, right-click .htaccess » “Rename” and name it .htaccess-vechi.
2. Reload the website. If it works, that was the problem: open the old file with “Edit” and look for the blocking rule. On WordPress, you can rebuild a clean .htaccess from the dashboard, under Settings » Permalinks » Save Changes.

5. Only the WordPress dashboard shows 403

If /wp-admin or /wp-login.php shows 403 but the rest of the website works, “Restrict admin access” is probably turned on in Enhance and your IP address has changed. On the WordPress page in the “Apps” tab, under “Security”, add the new IP or turn the option off (see WordPress updates and security in Enhance). It can also be a WordPress security plugin that locked you out after too many attempts.

If something doesn't work

• It's none of the causes above. Send us the exact address, the time you saw the error and what you were doing (opening a page, submitting a form, saving something in WordPress). A security filter, on the server or in a plugin, can sometimes mistake a regular form for an attack; we will check whether that is the cause.
• The error only shows up for you. Try from mobile data. If it works from there, your IP address may be blocked after many wrong passwords; send us your IP (you can find it by searching Google for “what is my ip”).
• The domain shows 403 right after you pointed it to us. That's normal until you upload the website (cause 1). If the website was already uploaded, check under “Domains” that the domain is on the right website.