---
title: Why is my site getting a 403 error?
description: A 403 Forbidden on cPanel hosting is almost always file permissions or file ownership. Here's how to check and fix both.
sidebar:
  order: 3
---

import { Steps, Aside } from '@astrojs/starlight/components';
import Support from '~/content/partials/support-link.mdx';

A **403 Forbidden** means the web server found your file but refused to serve it. On our cPanel servers that's nearly always one of two things: permissions that are wrong, or files owned by the wrong user.

We run **suEXEC**, which makes your site's code run as *your* account rather than a shared web-server user. That's a security benefit — one account can't read another's files — but it does mean the server is strict about ownership and permissions.

## The correct values

| Item | Permissions |
| --- | --- |
| Folders | `755` |
| Files | `644` |

Anything **more permissive** (a folder at `777`, a file at `666`) is refused by suEXEC. This surprises people, because loosening permissions is the instinctive fix for a permissions error — here it makes things worse, and it's a genuine security risk.

## Fixing it in cPanel

The File Manager handles this without needing a terminal:

<Steps>

1. Sign in to cPanel and open **File Manager**.

2. Navigate to the site's folder. For your primary domain that's normally `public_html`.

3. Select the folder or file, then click **Permissions** in the toolbar.

4. Set folders to `755` and files to `644`. To apply to everything beneath a folder at once, tick the **recurse into subdirectories** option and choose whether it applies to files or folders — you'll need one pass for each, since they take different values.

</Steps>

## When ownership is the problem

Permissions are only half of it. Files also have to be owned by your account.

- **Uploaded over FTP or SFTP?** Ownership is almost certainly fine — the files were created as you.
- **Pulled the site down over SSH** with `git clone`, `wget`, `curl`, or unpacked an archive as another user? Ownership may be wrong, and no amount of `chmod` will fix that. The files need `chown` back to your account.

If you suspect ownership, [open a ticket](https://secure.anhonesthost.com/submitticket.php) — it's a one-command fix from our side and safer than guessing.

<Aside type="caution">
  Be careful with recursive commands over SSH. A `chmod -R 777` or a `chown` aimed at the wrong path can break your whole account, and in the case of `777` will leave the site returning 403 anyway. If you aren't confident, ask us.
</Aside>

## If permissions and ownership are both correct

Other causes of a 403:

- **No index file.** A folder with no `index.html` or `index.php`, on a server with directory listing disabled, returns 403.
- **An `.htaccess` rule** denying access — either one you added, or one a security plugin wrote.
- **A security plugin or firewall** blocking your IP after failed logins. Try from a different network or your phone on mobile data; if that works, it's an IP block.

## Related

- [Get your free SSL certificate](/cpanel/free-ssl-certificate/)

## Still stuck?

<Support />