Unlike a 404, a 403 Forbidden does not mean the page is missing. The server found the requested address but decided you are not allowed to see it. That decision can be made at several layers: filesystem permissions, web server configuration, .htaccess rules, security plugins or a network-level IP block. Before fixing anything, work out who sees the error and on which URL, because that narrows the cause considerably.
Who sees it, and where
Is the whole site affected or only one folder such as /wp-admin/ or /uploads/? Does everyone get it, or only your computer and office network? Try opening the site over mobile data. If it loads there but returns 403 on the office Wi-Fi, an IP block is almost certainly the cause. If only the homepage fails while inner pages work, look at the index file; if only a particular folder fails, check the .htaccess and permissions inside it.
Missing index file
When you open example.uz, the server looks for index.php or index.html in the site root. If neither exists and directory listing is disabled, the result is 403. This typically happens when an archive is extracted into a subfolder like www/example.uz/site/, leaving the root empty. Move the files to the right place rather than enabling directory listing, which only weakens security.
File and folder permissions
If the web server cannot read a file, it returns 403. Use 755 for directories and 644 for files; modes like 700 or 600 block a web server running as a different user. Some FTP clients and archive tools set them wrongly:
ls -la ~/www/example.uz
find ~/www/example.uz -type d -exec chmod 755 {} \;
find ~/www/example.uz -type f -exec chmod 644 {} \;Ownership matters too. Files created as root or another user may be unreadable for the site user. The ISPmanager file manager shows the owner and mode and lets you change both.
Deny rules in .htaccess
Access restrictions in .htaccess sometimes fire where you do not expect. An IP restriction protecting the admin login will lock you out once your provider changes your address. In Apache 2.4 such rules look like this:
<Files "wp-login.php">
Require ip 203.0.113.10
</Files>
# or close a whole folder
Require all deniedOlder syntax uses Order deny,allow and Deny from all. To test, rename the file temporarily:
mv .htaccess .htaccess.offRemember that subfolders can have their own .htaccess. One in uploads that blocks PHP execution is good practice, but if it also blocks images, the site loads without pictures.
Security plugins and firewalls
WordPress security plugins temporarily block IPs after repeated failed logins, which can show up as a 403. At a private clinic in Samarkand, an administrator typed an old password several times from a new phone, the plugin blocked the office IP, and staff could no longer reach the dashboard. Clearing the plugin's blocked list or renaming its folder fixed it. Server-level protection can also block clients that send too many requests or suspicious patterns such as SQL in the URL. Those blocks are not visible to customers, so send your IP address to support if you suspect one.
Files that are meant to be blocked
Sometimes a 403 is correct. Many servers deliberately deny browser access to .env, .git, backup archives and config files because they contain passwords and keys. Download those through FTP or the file manager instead.
A quick checking order
- Open the site from another network to rule out an IP block.
- Confirm an index file exists in the site root.
- Reset permissions to 755/644 and check ownership.
- Disable .htaccess temporarily.
- Disable security plugins temporarily.
- Search the site error log for entries like "client denied".
The Apache error log usually names the rule or permission that caused the denial. If you still cannot find it, open a ticket in the sayt.uz cabinet with the URL and your IP address.