How to Fix 403 Forbidden and 500 Internal Server Errors

Both errors stop a page from loading, but they mean different things:

• 403 Forbidden: the server understood the request but won’t serve it. Usually a permission setting, a rule in a file called .htaccess, or a security block.
• 500 Internal Server Error: something on the server failed while building the page. Usually .htaccess, a plugin, a theme or a PHP setting.

.htaccess is a hidden settings file in your site’s folder. A single wrong line in it can cause either error.

Step 1: Read the error log

1. Log in to cPanel, click Performance in the sidebar and open the Recent Errors tab (older layout: the Errors icon). It lists recent web server errors, newest first.
2. Find lines from the time of the error. For example, a line with wp-content/plugins/contact-form/ points to the Contact Form plugin. Copy the whole line.
3. PHP errors may go to a file named error_log instead. In cPanel, click Files and open the File Manager tab (older layout: the File Manager icon), then your site’s folder (usually public_html). If error_log is there, select it, click More and choose Open; the newest lines are last.
4. No log? Go on to Step 2. We can read the logs for you in a ticket.

Step 2: Undo your last change

If the error started right after a change, such as a plugin update or a new security rule, undo it and reload the page.

Step 3: Test the .htaccess file

1. In File Manager, click More in the toolbar and select Show hidden files (older layout: click Settings, select Show Hidden Files and click Save).
2. Open public_html (or the folder for this site).
3. Select .htaccess, click More, choose Rename and change the name to .htaccess-old.
4. Reload your site. Still broken? Rename the file back to .htaccess and go to Step 4 or 5. If the site loads, the old file was the cause.
5. On WordPress, go to Settings → Permalinks and click Save Changes to create a fresh file.
6. Copy back blocks that plugins or cPanel added, one at a time, such as # BEGIN LSCACHE to # END LSCACHE, or a block mentioning lsapi_module (PHP settings). Open .htaccess-old with Edit (under More) and copy the block. Open .htaccess with Edit, paste it above # BEGIN WordPress and save.
7. Reload your site after each block. If the error comes back, remove that block.
8. Keep .htaccess-old for a few days. If you’re not sure what to copy back, or your PHP settings look different, open a support ticket.

Step 4: Check file permissions (403)

Permissions control who may read a file. WordPress recommends 755 for folders and 644 for files.

1. In File Manager, select the file or folder named in the error, then click Permissions.
2. Write down the current number so you can put it back. Leave wp-config.php at 400 or 440 if that’s what it is now.
3. Change the number to 755 for a folder or 644 for a file, and confirm.
4. Not sure which file is blocked, or the numbers were already right? Open a support ticket with the page address.

Step 5: Rule out a plugin or theme (500)

If the log names a folder in wp-content/plugins, switch that plugin off:

1. If you can log in to WordPress, go to Plugins and click Deactivate under it.
2. If you can’t log in, open wp-content/plugins in File Manager.
3. Select the plugin’s folder, click More, choose Rename and add -off to the end of its name (for example, contact-form-off). WordPress stops loading it.
4. Reload your site. To use the plugin again later, remove -off, then activate it under Plugins.

If the log names a theme in wp-content/themes, or says memory is exhausted, open a support ticket and paste the log line.

A 403 only on one form or page

If a 403 appears only when you submit one form or save one page, a security rule on the server may have blocked it. Don’t try to work around it. Open a support ticket with the page address and the exact time, and we’ll review the block.

How to tell it worked

The page loads in a private browser window, and no new lines appear in the error log when you reload it.

Troubleshooting

• 403 on your home page right after uploading a site: check that your site’s folder has an index.php or index.html file directly inside it.
• 403 on wp-config.php or debug.log: leave it. Those private files should never open in a browser. If debug.log does open, open a support ticket.
• The whole site is down, not just one error: work through website is down or not loading.

Still need help?

Open a support ticket from the Client Portal at my.bluearctic.com. Include the page address, the exact error, the time it happened, the matching lines from the error log, a screenshot, and what you already tried. Never include a password.