Random 403 Forbidden Error

Discover the causes and fixes for random 403 errors on your site.

As of January 2020, I’m seeing more reports of site owners encountering 403 Forbidden errors when working on their site, or even while trying to log in.

But the errors are somewhat random.

This post is to help us put the power of the village to work and serve as a place where site owners can report their experience and fixes.

Confluence of Changes

These errors are cropping up just at the time that 3 important changes happened with our site and hosting.

Those changes are:

• new rewrite condition from WP 5.6 placed in .htaccess
• updates to ModSecurity rules
• updates to cPanel software

Any one of the above could be the cause of these errors – and with your help, we’ll sort out which ones are in play.

My Working Theories

My first thought was that there was a new ModSecurity rule that was getting its wire tripped. And the only reason I question this guess is that it should be consistent and repeatable, which it’s not.

SEE: What is ModSecurity and Should You Turn it Off for details.

My second thought was that it had something to do with the rewrite rule in .htaccess that was placed there in the WP 5.6 update.

That rule is RewriteRule .* – [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

It is related to the new authentication needed for the new password authorization security WP also added in 5.6.

SEE: What’s New in WordPress 5.6 for more on the new REST API authentication with Application Passwords.

UPDATE: As far as I can tell, this new rewrite rule is not in play for this 403 error issue.

How to Report Your Error

To report to your host:

• note the time the error occurred
• exactly what you were doing when the error occurred
• contact your host with the time the error occurred along with your time zone, and ask them to check the system error logs at that time

To help us gather info, please include ALL of the following in your comment:

• exactly what you were doing when the error occurred
• what your host suggested you check, or what they checked (be specific)
• what fixed the problem, if you have a solution

Reports to Date

Following are the plugins and fixes reported so far.

I’ll post more of the comments here so they are in a more ordered list for us.

NOTE: Plugins listed here may not be the root cause of the issue. So take it with a grain of salt if the action listed for them does not fix the 403 error for you.

Turn off ModSecurity – some hosts are suggesting this as a quick fix – super bad idea to leave it off – see the post above for why

WP Rocket – deactivating/reactivating the plugin fixed the issue.

Qubley – deleting the plugin fixed the issue.

Special Characters – the use of hashtags in the sidebar could be considered an unrecognized special character, and thus considered a security issue. Ceasing to use that character stopped the problem.

Litespeed Server IP connection limits – for some site owners that do not have good site security, and are on hosts that use Litespeed servers, the site may be experiencing too many hits in a short timeframe from a single IP address. That would cause the security settings at the server to limit, or throttle, any further connections from that IP.

See the comments below

Thanks to all who have reported what they are seeing.

And please do read the comments below and let us know if something similar is happening to you.