403 Forbidden means something different from 404. The server found what you asked for but refuses to hand it over. The problem is not the address, it is who is allowed to read what. That narrows the causes down to a handful, and they are best checked in this order.
Open the front page and one subpage. If only one address returns 403, the problem is in that file or directory. If the whole site is closed, the cause is a server level setting, so start from step 3.
The server reads a file only if the permissions allow it. A working baseline is 644 for files and 755 for directories. Permissions usually go wrong after a migration or when files have been copied with the wrong account. You can see and correct them with an FTP client, see our guide to FTP and SFTP.
The .htaccess file in the site root can deny access to an entire directory. Look for lines such as Deny from all or Require all denied. Rename the file temporarily to .htaccess-old and reload the page. If the error disappears, that is where it comes from. In WordPress the correct content is easy to restore by saving the permalink settings again.
If a directory has no index.php or index.html and directory listing is not allowed, the server answers with 403. This is common right after a migration, when files have been extracted into a subdirectory instead of the root.
Security plugins block repeated login attempts and suspicious requests. If your own IP address has ended up on the block list, you see 403 while the site works for everyone else. Test on a mobile connection. If the site opens on your phone but not at the office, the block is tied to your address and it is lifted from the plugin or the server block list.
The wp-admin directory may be protected separately with a password or an IP restriction, in which case the public site works normally. Check the directory protections in your hosting panel before looking for the fault inside WordPress.
Do not set permissions to 777. It removes the error for a moment and opens the site to anyone with access to the server. If 403 appeared together with other odd symptoms, read our guide on a hacked website as well, because file permissions are often rewritten after a break-in.
We find out where the block comes from and open the site without loosening permissions at the cost of security. We answer during the same working day, and a site that is completely down is taken on within twenty four hours.
