How to Fix: WordPress Access Denied

WordPress access denied errors occur when your server, security plugin, or WordPress itself blocks access to a page, file, or admin area—most commonly showing as 403 Forbidden, “Access Denied,” or “Sorry, you are not allowed to access this page.” Fix the specific cause—file permissions, corrupted .htaccess, security plugin rules, firewall blocks, or missing capabilities—rather than applying blanket changes.

Access denied errors are among the most frustrating WordPress problems because they can lock you out of your own website, block visitors from critical pages, or prevent search engines from indexing content. The good news: most access denied issues are fixable in 10–30 minutes once you identify the exact cause.

This 2026 guide shows you exactly how to diagnose and fix WordPress access denied errors using systematic troubleshooting—without guesswork, downtime, or risking your live site.

Last updated: September 2026

Quick Answer: Fastest Fixes for Access Denied

If you need immediate results, try these in order:

  1. Clear browser cache and test in incognito/private mode.

  2. Regenerate .htaccess — rename .htaccess to .htaccess-old, then go to Settings → Permalinks and click Save.

  3. Check file permissions — folders should be 755, files 644.

  4. Disable security plugins temporarily (Wordfence, iThemes, Sucuri).

  5. Clear CDN/firewall cache (Cloudflare, Sucuri WAF, host firewall).

  6. Scan for malware — infected sites often get blocked by hosting firewalls.

What Does “Access Denied” Mean in WordPress?

“Access denied” is a generic term that covers several different HTTP error codes and WordPress-specific messages:

Error type What it means Typical cause
403 Forbidden Server understands the request but refuses access File permissions, .htaccess rules, WAF blocks
401 Unauthorized Authentication required but not provided Password protection, basic auth, API auth missing
“Sorry, you are not allowed to access this page” WordPress loaded but your account lacks capability User role issue, plugin conflict, database prefix mismatch
“Access to this resource on the server is denied” Server-level block before WordPress loads .htaccess deny rules, hotlink protection, IP blocks

Understanding which type you’re facing determines the fix.

Common Causes of WordPress Access Denied

Access denied errors typically stem from one of these root causes:

1. Corrupted .htaccess File

A single bad line in .htaccess can block your entire site or specific paths like /wp-admin/.

2. Incorrect File Permissions

Files set to 600 or directories set to 700 may be too restrictive for the web server to read.

3. Security Plugin Overblocking

Wordfence, iThemes, All In One WP Security, and Sucuri can block legitimate requests by mistake.

4. CDN or Firewall Rules

Cloudflare WAF, Sucuri firewall, or host-level ModSecurity can flag normal requests as suspicious.

5. Missing or Corrupted Index Files

If index.php is missing from a directory, the server may return 403 instead of routing through WordPress.

6. Hotlink Protection Misconfiguration

Aggressive hotlink protection can block your own images, CSS, or JavaScript files.

7. IP Address Blacklisting

Too many failed login attempts can trigger automatic IP blocks in security plugins or server firewalls.

8. Malware Infections

Hosting providers sometimes block entire sites that show signs of compromise.

9. Database or Capability Issues

Corrupted user roles or missing capabilities can trigger WordPress-level “not allowed” messages.

Before You Start: Safety Checklist

  • Back up your site — files and database. Use your host’s backup tool or manual export.

  • Document the symptom — note exactly which URL shows the error, when it started, and what changed recently.

  • Gather access credentials — FTP/SFTP, hosting control panel, phpMyAdmin, or SSH/WP-CLI.

  • Enable error logging — add debug constants to wp-config.php to capture PHP errors.

  • Test from multiple devices/networks — rule out local cache or IP-specific blocks.

Step 1: Determine the Scope of the Problem

Before making changes, identify exactly what’s blocked:

Test These URLs

  • Homepage (https://yoursite.com/)

  • A blog post (https://yoursite.com/sample-post/)

  • wp-admin (https://yoursite.com/wp-admin/)

  • wp-login.php (https://yoursite.com/wp-login.php)

  • Specific assets (images, CSS, JS files)

Possible Scenarios

Scenario Likely cause
Entire site blocked .htaccess corruption, server firewall, DNS/hosting issue
Only wp-admin blocked Security plugin, IP block, capability issue
Only specific pages blocked Plugin conflict, custom rewrite rules
Only assets (images/CSS/JS) blocked Hotlink protection, CDN rules, file permissions
Works on mobile data but not WiFi IP-based block

 

Step 2: Clear Browser and Site Cache

Cached 403 responses can persist even after fixing the actual problem.

Clear Browser Cache

  • Chrome: Ctrl+Shift+Delete → Clear browsing data → Select “Cached images and files”

  • Firefox: Ctrl+Shift+Delete → Check “Cache” → Clear Now

  • Safari: Develop → Empty Caches

Clear WordPress Cache

If you use a cache plugin (WP Rocket, W3 Total Cache, LiteSpeed Cache):

  1. Go to the plugin’s settings in wp-admin (if accessible).

  2. Click “Purge All Caches” or “Delete Cache.”

Clear CDN Cache

If you use Cloudflare, Sucuri, or another CDN:

  1. Log into your CDN dashboard.

  2. Find “Purge Cache” or “Clear Cache.”

  3. Purge everything or specific URLs.

Test: Use an incognito/private window after clearing all caches.

Step 3: Regenerate the .htaccess File

A corrupted .htaccess file is the most common cause of access denied errors.wptroubleshooter+1

Method 1: Via File Manager or FTP

  1. Connect to your site via cPanel File Manager or FTP/SFTP.

  2. Navigate to the WordPress root (usually public_html).

  3. Find .htaccess — enable “Show Hidden Files” if you don’t see it.

  4. Rename it to .htaccess-old or .htaccess-backup.

  5. Test your site — visit the homepage and wp-admin.

If the site works, the .htaccess file was corrupted.

Method 2: Regenerate a Clean .htaccess

If you can access wp-admin:

  1. Go to Settings → Permalinks.

  2. Click Save Changes without changing anything.

  3. WordPress automatically generates a fresh .htaccess file.

Method 3: Manual .htaccess Creation

If you cannot access wp-admin, create a new .htaccess file manually with this standard WordPress content:

text

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

Upload this as .htaccess to your WordPress root directory.

Step 4: Check and Fix File Permissions

Incorrect file permissions are a leading cause of 403 Forbidden errors.

Recommended WordPress Permissions

Item Permission
Folders/directories 755
Regular files 644
.htaccess 644
wp-config.php 440 or 400 (extra secure)

Never set files or folders to 777 — it’s a major security risk and can trigger WAF blocks.

How to Fix Permissions via cPanel File Manager

  1. Open File Manager in cPanel.

  2. Navigate to your WordPress root (public_html).

  3. Select all folders → Right-click → Change Permissions → Set to 755.

  4. Select all files → Right-click → Change Permissions → Set to 644.

  5. Test your site.

How to Fix Permissions via FTP

  1. Connect via FTP/SFTP (FileZilla, Cyberduck).

  2. Select all folders → Right-click → File Permissions → Enter 755 → Check “Apply to directories only.”

  3. Select all files → Right-click → File Permissions → Enter 644 → Check “Apply to files only.”

How to Fix Permissions via SSH (Fastest)

bash

cd /home/username/public_html
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
chmod 440 wp-config.php

Replace /home/username/public_html with your actual WordPress path.

See more in this post: WordPress file permissions explained

Step 5: Disable Security Plugins Temporarily

Security plugins like Wordfence, iThemes Security, Solid Security, and Sucuri can block legitimate requests by mistake.

If You Can Access wp-admin

  1. Go to Plugins → Installed Plugins.

  2. Deactivate all security-related plugins.

  3. Test the blocked URL.

  4. If it works, reactivate plugins one by one to identify the culprit.

If You Cannot Access wp-admin

  1. Connect via FTP/SFTP or File Manager.

  2. Navigate to /wp-content/plugins/.

  3. Rename the security plugin folder:

    • wordfence → wordfence-disabled

    • ithemes-security → ithemes-security-disabled

    • sucuri-scanner → sucuri-scanner-disabledmiddlehost+1

  4. Test your site.

For more details Explore: disable WordPress plugins when locked out

Reconfigure the Blocking Plugin

Once identified:

  • Check the plugin’s firewall or block logs.

  • Whitelist your IP address.

  • Adjust firewall sensitivity settings.

  • Contact the plugin’s support with details. middlehost

Step 6: Check CDN and Firewall Rules

If you use Cloudflare, Sucuri Firewall, or a hosting-level WAF, a security rule may be blocking access

Cloudflare Users

  1. Log into your Cloudflare dashboard.

  2. Go to Security → Events.

  3. Review recent blocks for your domain.

  4. If your IP is blocked, whitelist it under Security → WAF.

  5. Temporarily enable Development Mode to bypass caching and some security rules.

Sucuri or Other WAF Users

  1. Log into your WAF dashboard.

  2. Check “Blocked Requests” or “Firewall Events.”

  3. Identify false positives (legitimate admin requests flagged as attacks).

  4. Whitelist your IP or adjust rule sensitivity.

Hosting Firewall (ModSecurity)

Some hosts use ModSecurity, which can block normal WordPress requests.

  1. Log into cPanel.

  2. Find ModSecurity or Security section.

  3. Temporarily disable ModSecurity.

  4. Test your site.

  5. If it works, contact your host to whitelist specific rules (don’t leave ModSecurity off permanently).

Step 7: Scan for Malware

Hosting providers sometimes block entire sites that show signs of malware infection.

Signs of Malware

  • Unexpected redirects to spam sites

  • New administrator accounts you didn’t create

  • Strange files appearing in uploads or root directories

  • Security warnings from Google or your host

  • Sudden drop in search rankings

How to Scan

  • Wordfence Scan — install and run a full malware scan.

  • Sucuri SiteCheck — free online scanner at sitecheck.sucuri.net.

  • Hosting malware scanner — many hosts offer built-in scanning tools.

If Malware Is Found

  1. Clean the infection (or hire a professional).

  2. Update all plugins, themes, and WordPress core.

  3. Change all passwords (WordPress admin, FTP, database, hosting).

  4. Contact your host to unblock the site after cleanup.

Step 8: Check for Missing Index Files

WordPress needs index.php in the root directory and certain subdirectories. If missing, the server may return 403.

How to Check

  1. Connect via FTP/SFTP or File Manager.

  2. Navigate to your WordPress root.

  3. Confirm index.php exists.

  4. Also check these folders for index.php:

    • /wp-content/

    • /wp-content/plugins/

    • /wp-content/themes/

If Missing

  1. Download fresh WordPress from.

  2. Extract the zip file.

  3. Upload only the missing index.php file(s) to the appropriate directories.

Step 9: Review Hotlink Protection Settings

Hotlink protection prevents other sites from embedding your images, but misconfiguration can block your own assets.middlehost+1

Symptoms

  • HTML loads but images/CSS/JS return 403 in browser DevTools.

  • Site looks broken (missing styles, blank image placeholders).

How to Fix

  1. Log into cPanel.

  2. Search for “Hotlink Protection.”

  3. Either disable it temporarily or add your domain(s) to the allowed list (include both www and non-www variants).

  4. Save and test.

Step 10: Check for IP Address Blocks

Too many failed login attempts can blacklist your IP address in security plugins or server firewalls.

How to Test

  1. Try accessing your site from a different network (mobile data, different WiFi).

  2. If it works, your original IP is likely blocked.

How to Unblock

  1. Contact your hosting support — provide your current IP (Google “what is my IP”).

  2. Check security plugin logs — Wordfence, iThemes show blocked IPs.

  3. Review cPanel IP Blocker — if available, remove your IP from the block list.

Step 11: Verify File Ownership (Advanced)

On VPS or dedicated servers, file ownership issues can trigger access errors even when permissions look correct.

Typical Ownership Settings

  • Shared hosting: username:username (your cPanel user)

  • VPS with Apache: www-data:www-data or apache:apache

  • VPS with Nginx + PHP-FPM: www-data:www-data

How to Check via SSH

bash

ls -la

Look at the owner and group columns. If ownership is wrong after a migration or manual upload, contact your host or run:

bash

chown -R username:username /home/username/public_html

Warning: Do not run chown blindly on shared hosting—ask your host first.

Step 12: Check WordPress User Roles and Capabilities

If the error is “Sorry, you are not allowed to access this page” (not a server 403), the issue is likely WordPress-level permissions.

Quick Checks

  1. Test with another admin account — if it works, the problem is user-specific.

  2. Check the user’s role — go to Users → All Users and confirm the account is set to Administrator.

  3. Review plugin-specific permissions — some plugins add custom capabilities that may be missing.

Fix Corrupted Capabilities

If user roles are corrupted:

  1. Access phpMyAdmin.

  2. Open the wp_usermeta table.

  3. Find the row where meta_key = 'wp_capabilities' for your user ID.

  4. Ensure meta_value contains:

    text

    a:1:{s:13:"administrator";b:1;}

  5. Save and test.

Refer to : Sorry, you are not allowed to access this page

Step 13: Contact Your Hosting Provider

If none of the above solutions work, the issue may be server-level (DNS, document root, hosting firewall, server misconfiguration).wptroubleshooter+1

What to Provide

  • Your domain and the exact URL returning the error

  • Whether you use Cloudflare or another CDN

  • Screenshot of the error message

  • Approximate time the issue started

  • Steps you’ve already attempted

Most hosting providers offer free support for access issues and can check server logs you cannot access.

Common Mistakes to Avoid

Setting Everything to 777

This creates a massive security risk and can trigger WAF blocks. Use 755/644 instead.

Deleting .htaccess Without a Backup

Always download a copy before renaming or deleting .htaccess — it may contain custom rules you need.

Disabling All Security Permanently

Temporarily disable security plugins to test, but re-enable them after fixing the root cause.

Ignoring JavaScript Errors

Some “access denied” issues are caused by JS conflicts, not server blocks. Check browser DevTools Console.

Not Testing from Multiple Networks

An IP block will only affect one network. Test from mobile data to confirm.

Prevention Checklist: Avoid Future Access Denied Errors

  • Keep WordPress core, plugins, and themes updated

  • Back up .htaccess before making changes

  • Document file permission settings after fresh installs

  • Configure security plugins with caution (avoid “maximum security” unless needed)

  • Use activity logs to track what changed before an error appeared

  • Set up uptime monitoring to catch 403 errors immediately

  • Whitelist your IP in security plugins and CDNs

  • Scan for malware monthly

  • Review hotlink protection settings after DNS changes

  • Test plugin updates on a staging site first

Frequently Asked Questions

What causes a WordPress access denied error?

Most commonly: corrupted .htaccess files, incorrect file permissions (755/644), security plugin blocks, CDN/firewall rules, or missing capabilities in WordPress user roles.

Can a plugin cause access denied?

Yes. Security plugins (Wordfence, iThemes, Sucuri) frequently block legitimate requests by mistake. Cache plugins can also serve stale 403 responses.

Will deleting .htaccess break WordPress?

No. WordPress can automatically generate a new one through Settings → Permalinks → Save Changes. Always back up first, though.

Is access denied dangerous?

The error itself isn’t dangerous, but it can indicate underlying issues like malware, misconfigured security, or server problems. It also blocks visitors and search engines.

How do I fix 403 Forbidden in cPanel?

Start in cPanel File Manager: check permissions (755 for folders, 644 for files), temporarily rename .htaccess, and disable security plugins. Review cPanel Metrics → Errors for WAF hits.

Why do images or CSS return 403 but HTML loads?

This pattern usually points to hotlink protection or a firewall rule blocking specific file types or referrers. Check CDN rules and hotlink settings.

Can Cloudflare cause access denied 403 errors?

Yes. Cloudflare can return 403 when firewall rules, WAF managed rules, bot protection, or rate limiting blocks the request at the edge. Temporarily pause Cloudflare security to test.

What’s the difference between 401, 403, and 500 errors?

  • 401 Unauthorized: Authentication required (login needed).

  • 403 Forbidden: Server refuses access (permissions/rules).

  • 500 Internal Server Error: Server encountered a fatal error (PHP crash, bad .htaccess).

Discover more from WORDPRESS ROLE

Subscribe to get the latest posts sent to your email.

Related Posts

Discover more from WORDPRESS ROLE

Subscribe now to keep reading and get access to the full archive.

Continue reading