Quick answer
A 403 Forbidden response means the server refused the request. Check the exact URL, domain folder, index file, and access rules before changing anything. A missing index page can cause a 403, but permissions, security rules, and application settings can also be responsible.
Check the website and folder
- Record the full failing URL and the time/time zone. Check whether the home page, one folder, or the entire website fails.
- Open cPanel > Domains and confirm the document root for that hostname. In File Manager, inspect that folder. Do not assume an addon domain uses public_html itself.
- For a new static site, confirm that an entry file such as index.html exists in the document root. Uploading a parent folder can leave the real index file one level too deep. Preserve any existing WordPress index.php.
- Review recent changes to file ownership/permissions, .htaccess, password protection, security plugins, or Cloudflare. Check cPanel > Errors or the relevant private application log for a matching request.
- Reverse the specific recent change only when you know what it did and have a copy of the previous setting. Do not make all files writable or remove every security rule.
Use the symptom to choose the next check
- Only a folder fails: check its index file, directory access settings, and folder-specific rules.
- Only one browser, IP, or country fails: record any security/ray/request ID and ask about an access rule or firewall event.
- WordPress administration works but a public page fails: check the page/application and security-plugin rules as well as server logs.
- The page is actually a Cloudflare error: record the precise error and request ID; a proxy response needs different evidence from an origin Apache 403.
Check the result
Open the exact failing URL again after the targeted correction. Check another page and confirm that protected folders still require the expected access.
Contact support
Send the domain, failing URL, timestamp/time zone, error text, and the last change you made. Redact private paths, session tokens, and customer data from screenshots or logs.
Website returns 403 after upload
Compare the domain's documented root with the upload destination and confirm the expected index file is at that level. Check the exact request in the available error log before changing permissions or access rules. Review the upload checks if extraction or a parent folder put files in the wrong location. Send support the precise error evidence if the expected public entry file is present and the refusal remains.
Match the refusal to the request
Check that the response is actually 403 Forbidden. An expired HTTPS certificate, a missing-page 404 and a WordPress fatal error require different evidence. For an access rule, record the precise hostname, path and request time rather than changing permissions across the whole account.
If cPanel's Metrics > Errors tool is available, compare the matching entry with the failed request. Its recent entries are not a complete application/security history; some blocks occur at the CDN or application before the expected origin entry exists. Keep request identifiers and ask support to correlate the correct layer.
Related help
- Find the correct document root before an AI tool uploads files
- Fix website file permissions without making everything writable
- Use website error logs to diagnose a failed request
- Investigate a legitimate request blocked by Cloudflare
- Upload a reviewed file with cPanel File Manager
- Send a website support request with useful troubleshooting details
- Check and troubleshoot HTTPS certificates for your domain
- Report and investigate a WordPress critical error
Last content review: October 31, 2026. Check the version and features available in your own account.
Customer troubleshooting and related-help review: November 1, 2026. Earlier review notes retain their original scope.
Customer symptom and related-help review: November 1, 2026.
