How to Fix “403 Forbidden” on WordPress Pages, Forms or Admin Actions
A 403 means something refused the request on purpose. Read the headers and body to find which layer sent it, then fix that layer without switching off security.
Field guides
Step-by-step fixes for every website emergency we cover: WordPress errors, outages, hacks, SSL, DNS, email, speed, redirects, stores, SEO and design problems. Plain language first, with the technical depth to back it up.
A 403 means something refused the request on purpose. Read the headers and body to find which layer sent it, then fix that layer without switching off security.
You see the new page, visitors see the old one, or the reverse. Read the cache headers to find which layer served it, then purge in the right order.
Blocks flagged as invalid or “Your site doesn’t include support” after a theme switch, plugin removal or update. Recover them without losing content.
Place order spins forever or shows “There was an error processing your order”. Read the checkout request in the Network tab, check the logs, then fix the gateway, cache or script.
Customers paid but orders sit in Pending payment or On hold, and no order emails arrive. Prove whether the gateway webhook reaches your site, then fix delivery and email.
Products vanish from the cart, the mini cart shows the wrong count, or checkout says your session has expired. Trace the session cookie, then fix cache rules and domains.
After a WooCommerce update the store looks wrong, orders vanish from a report or an extension errors. Finish the database update, fix template overrides and HPOS, or roll back.
Product pages load fine but cart, checkout and filtered shop pages crawl. Measure the uncached path, then fix fragments, geolocation, variations, lookup tables and object cache.
Pick the right restore point, restore from a host snapshot, a backup plugin or raw files plus a SQL dump, and keep the orders and comments that arrived since.
Move WordPress without a migration plugin: dump the database, copy the files, import, run a safe search-replace, test through your hosts file, then switch DNS.
Fix failed WordPress SQL imports: MySQL server has gone away, phpMyAdmin limits, unknown collation utf8mb4_0900_ai_ci, DEFINER errors, row size too large and mojibake.
A full staging push overwrites every order, customer, review and form entry that arrived on live since you cloned it. Here is how to deploy changes and keep that data.
No backup? Check host snapshots, CDN caches, the Wayback Machine and old copies first, then rebuild from feeds and uploads, or rescue a database MySQL will not start.
Move a WordPress site to a newer PHP version without downtime: check support dates, scan plugins for incompatible code, test on staging, switch per site and roll back fast.
Uploads fail with upload_max_filesize, “exceeds the maximum upload size” or 413 errors. Find which layer set the limit (PHP, web server, WAF or CDN) and raise the right one.
Uploads fail, updates say “Could not create directory”, the database refuses writes or mail bounces. Find what is eating disk space or inodes and clear it safely.
Scheduled posts show “Missed schedule” and backups or emails never run. Find out why WP-Cron is not firing, replace it with a real system cron and clear stuck events.
Site Health flags a failed loopback request or a REST API error. Learn what the test does, test it from the server with curl, and fix DNS, firewall, auth and plugin causes.
Most broken Cloudflare moves come from a record the import scan missed, a proxied mail hostname or DNSSEC left on. Audit, compare and switch in the right order.
Usually the change was made at a DNS host your domain does not use, or a cache is holding the old answer. Ask the authoritative servers first, then work outward.
A subdomain needs three things: a DNS record, a server that knows the name, and a certificate that covers it. Test each one separately and the broken link shows itself.
A registrar transfer moves the registration, not your website or mail. Downtime comes from DNS hosted at the old registrar. Secure the zone first, then transfer.
Web records point at the web host and mail records point at the mail provider. Mail breaks when a new host replaces the zone, or its server still thinks it handles your mail.
Your contact form fills your inbox with junk. Find how the spam arrives, then layer honeypots, Turnstile or CAPTCHA, Akismet, validation and rate limits.
Search the field manual
Or jump straight to a symptom
Press / to search from any page, Esc to close