Turkey (Turkish)
Germany (German)
Worldwide (English)
WordPress LayerKernel, theme and plugin behavior.
Halkali merkez neighborhood fatih st ozgur apt no 46 , Kucukcekmece , Istanbul , 34303 , TR
403 Forbidden means the request reached the server but was denied by the access policy. In WordPress, file permissions, .htaccess deny rules, ModSecurity, security plugins, CDN WAF, nonce, and IP blockers should be checked separately.
403 Forbidden
You don't have permission to access this resource
ModSecurity: Access denied with code 403
rest_cookie_invalid_nonce403 indicates that the source may exist but access is denied to the current user, IP or request type. Therefore, instead of searching for content like 404, there should be a layer that denies access.
If only wp-admin or admin-ajax.php is affected, security plugin, ModSecurity rule, IP allowlist, and nonce control are the top priority.
If the entire site returns a 403, check document root permissions, file ownership, parent directory execute permissions, and Deny/Require rules in .htaccess.
Cloudflare WAF or bot protection can generate a 403 before reaching the origin. The response header and ray ID help to distinguish between CDN and origin errors.
Invalid or expired nonces in WordPress REST API requests can result in a 403. Instead of disabling nonce checks, cache and session flow should be fixed.
Making all files and folders 777 is a security risk and doesn't solve ownership issues. WordPress permissions should be evaluated in conjunction with the server user and PHP execution model.
Search for the phrase you see in the email, browser, or SSH log. Each card includes meaning, probable cause, and safe initial action.
Meaning: The server has rejected the access request.
Possible cause: Permission, WAF, deny rule, or security plugin.
Meaning: Apache/Nginx or file system does not allow access.
Possible cause: Incorrect ownership, Directory rule or deny.
Meaning: WAF rule marked the request as an attack.
Possible cause: The form content is similar to SQL or a false positive.
Meaning: The nonce value of the REST request is invalid.
Possible cause: Cache, session or incorrect header.
Meaning: The management path has been specially blocked.
Possible cause: Wordfence, IP rule, Basic Auth or ModSecurity.
Meaning: AJAX request was rejected by WAF or nonce.
Possible cause: Plugin request, security rule or cache.
Meaning: Apache configuration has rejected the client.
Possible cause: Require/Deny/Allow rule.
Meaning: Cloudflare firewall rule has blocked the request.
Possible cause: WAF/Firewall Rule or bot score.
No records matching this expression were found.
Commands are for root access. Collect only status and logs first; Do not change the permanent setting without seeing the reason.
curl -sSIk https://example.com/wp-admin/Shows headers indicating that 403 came from Cloudflare, Nginx or Apache.
find . -maxdepth 2 -printf '%m %u:%g %p\n' | head -n 80Displays unusual permissions and ownerships in the root directory
grep -RniE 'deny from|require all denied|<files|<directory' .htaccess wp-content 2>/dev/nullFinds blocking access rules.
grep -Ri 'ModSecurity' /usr/local/apache/logs/error_log /var/log/apache2/error.log 2>/dev/null | tail -n 50Shows the Rule ID and the blocked request.
wp user list --fields=ID,user_login,rolesVerifies that the WordPress user and role hierarchy is working.
wp plugin list --status=active | grep -Ei 'wordfence|security|firewall|limit'Lists security or access plugins.
The root cause of the WordPress error is the same, but log paths, PHP settings screens and service management vary depending on the hosting infrastructure used.
cPanel controls ModSecurity, IP Blocker, Hotlink Protection, and File Manager.
grep -i 'ModSecurity' /usr/local/apache/logs/error_log | tailWeb Application Firewall, Fail2Ban, and domain logs are highlighted in Plesk.
plesk bin ip_ban --bannedOn a panel-less server, vhost access rules, WAF, and file ownership are directly reviewed.
grep -RniE 'deny all|Require all denied' /etc/nginx /etc/apache2 2>/dev/nullDetermine the layer producing the 403 response; then narrow down IP, WAF, file permission, and WordPress nonce/plugin checks.
Test whether all sites, wp-admin, REST API, or only specific forms are affected.
curl -sSIk https://example.com/wp-admin/Separate the CDN, web server, or WordPress layer
Record the wrong positive request and rule ID without completely closing the rule.
Compare WordPress directories with secure ownership and permissions.
find . -maxdepth 2 -type d -printf '%m %u:%g %p\n' | headOnly temporarily disable the plugin marked in the log.
wp plugin list --status=activeTest nonce, AJAX, and real user operations.
curl -sSIk https://example.com/wp-json/Firewall, Fail2Ban, Wordfence or CDN IP block check.
curl -sSIk https://example.com/ModSecurity false positive, nonce and request body content are examined.
Admin IP rule, security plugin, and Basic Auth are checked.
The Security Events record is found with the Ray ID and the matching rule is examined.
MIME, WAF body limit, upload directory, and nonce are checked.
404 means resource not found, while 403 means access is denied even if the resource exists.
The general rule is that files are 644, directories are 755; however, ownership and server model must be taken into consideration.
No. The rule ID of the false positive should be found and, if possible, a controlled exception should be applied only for the relevant domain or request.
Yes; IP, rate limit, country block or firewall rule can block the request.
Indicates that the Cloudflare firewall rule has blocked the request; the event can be found with the Ray ID.
The page, cache, or old session nonce may have expired.
Origin logs, security add-on logs, WAF rule ID, and IP blockers are checked together.
By analyzing cPanel, WHM, CloudLinux, LiteSpeed, MariaDB, Exim and security layers together, we fix the root cause of the failure instead of just removing the service.