Why does my website show 403 Forbidden?

A 403 Forbidden response means the server refused access to that address. It can come from a missing home page, file access rules or a security rule. Record the affected URL and the time, then check the website's folder and matching error entries before changing anything.

Check which requests fail

Open your home page and one other public page. Note whether the error affects the whole website, one folder, a login page or a particular form submission. Keep the full address, including www or a subdomain.
Note what happened immediately before the error: an upload, website move, new security rule or a file change. A 403 when opening a folder directly can be intentional when the server does not allow visitors to list its contents.
If a form or checkout triggers the error, do not submit it repeatedly. Check whether its earlier submission succeeded before trying again. Tell us the action that led to the error, without sending payment details or passwords.

Check the website folder and error

Sign in to your account, open the hosting service in Services and choose Log in to cPanel. On a phone, choose cPanel. Check the service's domain before opening it.
In cPanel, open Domains and find the affected domain. Check its document root, which is the folder used for that website. Two domains sharing a document root will use the same files. Do not assume that every domain uses public_html.
Open File Manager and navigate to that folder. Look for the home-page file your website is supposed to use, such as index.php for WordPress or index.html for a static site. If an upload left the website inside an extra folder, compare the location with our upload guide. Do not create an empty index file just to hide the error.
Open Errors in cPanel. Under Latest web server error log messages, look for an entry matching the domain, requested path and time. A line mentioning access denial, permissions or a security rule helps identify the cause. If no matching entry appears, send us the URL and failure time so we can check the relevant logs.

Make only a confirmed correction

If the correct home-page file was omitted, prepare that file from your known-good website copy. Back up the existing website before uploading or replacing files in its live folder.
If the error began after an access-rule change, ask the person who made it to review that exact change. Do not delete .htaccess, remove a password restriction or switch off security across the account to test a guess. Those changes can expose pages that should stay private.
If permissions or file ownership appear in the error, send us the message and affected path. Do not make every file writable or apply one permission setting to the whole account. Different files can require different access rules.
If a security rule blocks a legitimate request, send us its time, URL and action through a support ticket. We can investigate the specific request without you disabling protection for the whole website.

Check the result or ask us to investigate

After a confirmed correction, reload the affected public page and another page that already worked. For a form, use one controlled test after checking for a previous successful submission.
Contact Tech/Server through Support → New Ticket with the domain, exact URL, time and timezone, error text, recent changes and the checks you made. Share only the relevant log lines through the ticket, not a public page or a full log containing other visitors' details.