Opening wp-admin, saving a setting, uploading, or performing another WordPress action returns 403 Forbidden.
You do not have to become a server administrator because one part of your website stopped cooperating. Start with the checks that stay inside WordPress. If the problem moves into hosting or server configuration, I will show you where the risk begins—and where it may make more sense to hand the headache to me.
Start with the checks inside WordPress
- Try a private browser window and sign in again.
- Turn off a VPN temporarily if the block began after an IP change.
- Confirm that the admin URL is correct and note whether only one action returns 403.
After each change, test the same action again. Change one thing at a time so you know what helped and what did not.
A good place to pause
When this leaves normal WordPress editing
A 403 response is an access decision. It may come from a security plugin, hosting firewall, ModSecurity rule, proxy, IP block, or filesystem permission.
If you inherited the website, took over after parting ways with a developer, or normally use WordPress only to add photographs and text, you may have never opened cPanel before. That is normal, but if you are new to backend server configuration, you need to proceed with caution. This is where you can break your site.
You also do not need to end up with more damage than you bargained for just to solve one aggravating problem. The standard repair is $149.00 if you would rather hand it off.
If you are comfortable with backend server configurations, continue with the technical steps below.
Technical checks
- Check security-plugin logs for the blocked request.
- Review ModSecurity or the hosting firewall events at the exact time of the 403.
- Check Cloudflare or another proxy for firewall rules, bot rules, or an IP block.
- Verify permissions on the specific admin file only after security rules are ruled out.
Proceed with caution
Do not disable every security layer to make the message disappear. Find the layer issuing the 403 and adjust the narrowest rule.
Test the repair without making a second problem
- Keep a note of the original setting or filename before you change it.
- Make one change, clear only the relevant cache, and repeat the exact test.
- Check both the public page and the WordPress dashboard.
- If the error changes, stop and record the new message before continuing.
You can hand this off
If these checks have taken you beyond the part of WordPress you normally use, you can stop. I can trace the cause, make the repair, test the site, and tell you what was changed without turning one problem into your new full-time job.