A 403 Forbidden response is an access problem, not the same thing as a missing page. First determine whether it affects the whole site, wp-admin, one file or only your current IP address.
Check the scope
Try the homepage, an inner page and wp-admin separately. Test from another network if practical. A single-IP problem suggests a firewall or security block; a single-file problem suggests permissions or rules around that path.
Review recent security or .htaccess changes
If the error started immediately after adding a redirect, security rule or plugin, revert that specific change first rather than loosening all permissions.
Check file and folder permissions
Incorrect permissions can block access, but setting everything to overly permissive values is unsafe. Use the hosting provider’s recommended values and restore from known-good settings where possible.
Check security plugins and hosting protection
A WordPress security plugin, WAF or hosting protection may block an IP or request pattern. Hostinger’s troubleshooting collection includes 403 guidance and wp-admin access troubleshooting.
When to contact Hostinger
If permissions and site rules look normal but the server continues to return 403, provide support with the exact URL, time, your public IP and any request/error ID shown. That is more actionable than saying only that “the site is down”.
403 diagnosis checklist
Use the symptom to choose the next check instead of changing several settings at once. Make one change, retest the exact URL, and keep a note of what changed.
| Symptom | What it suggests | Next check |
|---|---|---|
| One IP only | Site works from another network | Check firewall/security block |
| One path only | Most pages work | Review path rules and permissions |
| After .htaccess edit | Failure started immediately | Restore known-good rules |
| wp-admin only | Public site works | Check security plugin/WAF/login protection |
Before you make a risky change
Take a current backup or restore point before editing configuration files, permissions, PHP settings or database URLs. Avoid deleting unrelated DNS, email, security or rewrite rules simply to see whether the problem disappears.
How to confirm the fix
Retest the exact public URL in a private browser window and, where relevant, on a second device or network. A fix is only confirmed when the original symptom is gone without creating a new error elsewhere on the site.
