Error 403 · configuration
403 Forbidden
The server found what you asked for and refused to serve it — a permissions, index, or access-rule problem rather than a missing file.
Also seen as: Forbidden · You don't have permission to access this resource · Access denied
What it actually means
403 is categorically different from 404. A 404 means not found; a 403 means found, and refused. The file or directory exists and the server has decided you may not have it.
There are four realistic reasons on shared hosting: filesystem permissions, a missing index file, an explicit deny rule, or files uploaded to the wrong directory. The last one accounts for a surprising share of “my brand new site shows 403” reports.
Why it happens
No index file in the directory
You requested a directory rather than a file. The server looks for index.html, index.php, and so on; finding none, and with directory listing disabled (as it should be), it returns 403.
If your homepage is Index.html or home.html, this is your problem — the name and the capitalisation both matter on Linux servers.
Files are outside the web root
Uploading to your account’s top level rather than into the public directory — htdocs, public_html, or www depending on the host — means the server is serving an empty web root.
Permissions too restrictive, or too loose
The server needs read access on files and execute (traverse) access on directories. 600 on a file or 700 on a directory blocks it.
Under suEXEC, permissions that are too permissive are also refused: a PHP file that is group- or world-writable will not execute.
An explicit deny rule
A Require all denied or an IP-based block in .htaccess, or a security plugin that has blocked your own address after failed logins. Security plugins locking out the site owner is common enough to check early.
How to fix it
1. Confirm where your files actually are
Your site must be inside the web root. Connect over FTP or open the file manager and verify the path — you are looking for index.html or index.php directly inside htdocs/public_html, not inside a subdirectory next to it.
Uploading a folder rather than its contents is the classic mistake: htdocs/mysite/index.html serves at /mysite/, not at /.
2. Check the filename exactly
Linux filesystems are case sensitive. Index.html is not index.html. Rename it in lower case and reload.
3. Reset permissions
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
Directories need the execute bit to be traversable, which is what 755 provides. Do not use 777 — under suEXEC it will make things worse, not better.
4. Look for a deny rule
Inspect .htaccess for access directives:
grep -n -i -E 'deny|require|order' .htaccess
Remember that rules are inherited: an .htaccess in a parent directory applies to everything beneath it, so check the web root even when the failing URL is several levels deep.
5. Rule out a security plugin
If it is WordPress and only you see the 403, a firewall plugin has likely blocked your IP. Rename the plugin’s directory over FTP to disable it, then whitelist yourself before turning it back on.
On CWP specifically
On CWP, your web root is htdocs. Files placed above it — next to it in your home directory — are not served, which is the intended behaviour for anything that should not be public.
A new account with no files serves a 403 rather than a 404, because the directory exists and is empty. That is normal: upload an index.html and it resolves immediately.
Related errors
-
500
500 Internal Server Error
Something in your application or server configuration crashed, and the server is deliberately withholding the detail from visitors — the real message is in your error log. -
REDIR
ERR_TOO_MANY_REDIRECTS
Two rules are sending the browser back and forth at each other, so it gives up after about twenty hops rather than looping forever. -
DNS
DNS_PROBE_FINISHED_NXDOMAIN
DNS has no record for this hostname at all — the browser never got as far as contacting a web server, so nothing about your hosting is involved yet. -
404
404 Not Found
The server is working and answered you — it just has nothing at the address you asked for. -
530
FTP 530 Login authentication failed
The FTP server rejected your credentials — usually the wrong username format, or a client trying to connect without TLS.
Post the exact error and your account name on the community forum — staff and other users answer there, and the thread helps the next person who hits this.