Forbidden (403): You don't have permission to access / on this server

Are you getting the message below on your website? In this article you'll read what usually causes it and how to fix it, also if you're using WordPress.

Forbidden. You don't have permission to access / on this server.

The most common cause: no start file

Usually there's no start file in the folder you're requesting. If you request www.yourdomain.com, the server looks for an index.php or index.html in domains/yourdomain.com/public_html. If it's not there, or your website is in a different folder, you'll get this message. Check it in File Manager.

Other causes

• A rule in your .htaccess file is blocking access, for example Deny from all.
• The permissions of a folder or file are too strict. Folders should be set to 755 and files to 644.
• The Web Application Firewall or Imunify360 has blocked a request because it looked like an attack.

A 403 on your WordPress site

Are you getting the 403 in WordPress, for example after an update, when saving, or in the admin? Then go through these steps.

1. Turn off your security plugin. Plugins like Wordfence, iThemes Security, or All In One WP Security have their own firewall. If you can no longer get into WordPress, rename the plugin's folder in File Manager under wp-content/plugins, for example rename wordfence to wordfence-off. WordPress will then disable the plugin. If your site works again, check the plugin's settings or logs to see what it was blocking, and then give the folder its old name back.
2. Restore the default WordPress .htaccess. First save a copy of your current .htaccess in public_html. Then replace the content with:

   # BEGIN WordPress
   <IfModule mod_rewrite.c>
   RewriteEngine On
   RewriteBase /
   RewriteRule ^index\.php$ - [L]
   RewriteCond %{REQUEST_FILENAME} !-f
   RewriteCond %{REQUEST_FILENAME} !-d
   RewriteRule . /index.php [L]
   </IfModule>
   # END WordPress

   If it works after that, the error was in one of the other rules. Add them back one by one to see which one it is.
3. Check the permissions. Folders at 755, files at 644. wp-content/uploads must also be writable for your website. See File and folder permissions (chmod).
4. Check the error log. In DirectAdmin, open Site Summary & Statistics and view the error log for your domain around the time of the error. If there's a line with ModSecurity: Access denied with code 403 or IM360 WAF, the firewall is blocking the request. See Site Summary and Statistics.
5. Disable firewall rule. If you only get the 403 when saving or uploading, you can disable just the rule causing the problem in Web Application Firewall. Never turn off the firewall completely. If it's a message from Imunify360, send us the rule and the address of the page. See Imunify360: scanning your website for malware.

Can't figure it out? Send us a ticket with the time it went wrong, the address of the page, and what you were trying to do. Then we'll look into it for you.

Also see in the DirectAdmin manual: Showing and editing hidden files such as .htaccess.

Detailed explanation: Error 403 or 406 when saving or uploading in the DirectAdmin manual.