# 403 Forbidden > The server found what you asked for and refused to serve it — a permissions, index, or access-rule problem rather than a missing file. Source: https://cwp.sg/errors/403-forbidden/ Author: Ben Johnson Last verified: 2026-08-02 **Also seen as:** Forbidden, You don't have permission to access this resource, Access denied ## What it means `403` is categorically different from `404`. A `404` means *not found*; a `403` means **found, and refused**. The file or directory exists and the server has decided you may not have it. There are four realistic reasons on shared hosting: filesystem permissions, a missing index file, an explicit deny rule, or files uploaded to the wrong directory. The last one accounts for a surprising share of "my brand new site shows 403" reports. ## Why it happens ### No index file in the directory You requested a directory rather than a file. The server looks for `index.html`, `index.php`, and so on; finding none, and with directory listing disabled (as it should be), it returns `403`. If your homepage is `Index.html` or `home.html`, this is your problem — the name and the capitalisation both matter on Linux servers. ### Files are outside the web root Uploading to your account's top level rather than into the public directory — `htdocs`, `public_html`, or `www` depending on the host — means the server is serving an empty web root. ### Permissions too restrictive, or too loose The server needs read access on files and execute (traverse) access on directories. `600` on a file or `700` on a directory blocks it. Under suEXEC, permissions that are too *permissive* are also refused: a PHP file that is group- or world-writable will not execute. ### An explicit deny rule A `Require all denied` or an IP-based block in `.htaccess`, or a security plugin that has blocked your own address after failed logins. Security plugins locking out the site owner is common enough to check early. ## How to fix it ### 1. Confirm where your files actually are Your site must be inside the web root. Connect over FTP or open the file manager and verify the path — you are looking for `index.html` or `index.php` directly inside `htdocs`/`public_html`, not inside a subdirectory next to it. Uploading a folder rather than its contents is the classic mistake: `htdocs/mysite/index.html` serves at `/mysite/`, not at `/`. ### 2. Check the filename exactly Linux filesystems are case sensitive. `Index.html` is not `index.html`. Rename it in lower case and reload. ### 3. Reset permissions ``` find . -type d -exec chmod 755 {} \; find . -type f -exec chmod 644 {} \; ``` Directories need the execute bit to be traversable, which is what `755` provides. Do not use `777` — under suEXEC it will make things worse, not better. ### 4. Look for a deny rule Inspect `.htaccess` for access directives: ``` grep -n -i -E 'deny|require|order' .htaccess ``` Remember that rules are inherited: an `.htaccess` in a parent directory applies to everything beneath it, so check the web root even when the failing URL is several levels deep. ### 5. Rule out a security plugin If it is WordPress and only *you* see the `403`, a firewall plugin has likely blocked your IP. Rename the plugin's directory over FTP to disable it, then whitelist yourself before turning it back on. ## On CWP hosting specifically On CWP, your web root is `htdocs`. Files placed above it — next to it in your home directory — are not served, which is the intended behaviour for anything that should not be public. A new account with no files serves a `403` rather than a `404`, because the directory exists and is empty. That is normal: upload an `index.html` and it resolves immediately. --- Content Website Platform (cwp.sg) operates the free hosting it writes about; see https://cwp.sg/about/ for the methodology and the commercial disclosure.