A 403 Forbidden error in cPanel almost always means file or folder permissions are misconfigured — either too restrictive or, occasionally, too permissive (which the server blocks for security). The general rule: folders at 755, files at 644.
What Are File Permissions in Linux?
Every file and folder on a Linux server has three permission levels:
- Owner: the user who created the file (usually your cPanel username).
- Group: the group the owner belongs to.
- Others: any other process, including the Apache web server.
Each level has three types of access: read (r=4), write (w=2), and execute (x=1). The number you see in cPanel (like 755 or 644) is the sum of those values for each level.
| Permission | Numeric value | What it allows |
|---|---|---|
| rwx | 7 | Read, write, and execute |
| r-x | 5 | Read and execute (no write) |
| r-- | 4 | Read only |
| --- | 0 | No access |
What Are the Correct Permissions on Shared Hosting?
On the vast majority of shared hosting environments running Apache, the recommended values are:
- Folders: 755 — The owner can read, write, and traverse. Group and others can read and traverse. Apache needs to "execute" (traverse) folders to serve the files inside them.
- Files: 644 — The owner can read and write. Group and others can only read. Apache can serve the file, but no outside process can modify it.
- PHP scripts: 644 in most cases. Some servers using suEXEC or FastCGI require 600 or 640 — check with your provider.
- Sensitive config files (
.env,wp-config.php,config.php): 600 or even 400 — readable only by the owner.
Never use 777 in production. It lets any process on the server write to the file — a serious security risk — and many hosts actively block access to files with that permission.
How to Change Permissions from cPanel (File Manager)
- Log in to cPanel and open File Manager.
- Navigate to the file or folder you want to modify.
- Right-click → Change Permissions (or select the item and click the button in the top toolbar).
- Check or uncheck the boxes, or type the number directly (e.g. 755).
- For folders, use the option to apply recursively to all subfolders/files with care — it applies the same permission to all contents.
- Click Change Permissions to save.
How to Change Permissions via SSH or cPanel Terminal
If you have SSH access or cPanel's terminal, the chmod command is faster for bulk changes:
# Set all folders to 755
find /home/yourusername/public_html -type d -exec chmod 755 {} \;
# Set all files to 644
find /home/yourusername/public_html -type f -exec chmod 644 {} \;Replace yourusername with your cPanel username. These two commands are the standard starting point for resetting permissions in bulk.
Specific 403 Error Causes Related to Permissions
Folder Missing Execute (x) Permission
If a folder has permission 644 instead of 755, Apache can't traverse it to find the files inside. Result: 403. Fix: chmod 755 the-folder.
Missing Index File or Unreadable Index
If a folder has no index.php or index.html, Apache will try to list the directory contents. If directory listing is disabled (the default in production), it returns 403. Check that the index file exists and has permission 644.
777 Permission Blocked by the Server
Some hosts (and security systems like Imunify360) actively block files with 777 permissions and return 403. Change to 755 (folders) or 644 (files).
.htaccess Deny or Require Rule Blocking Visitors
A 403 can also come from an .htaccess rule blocking access — not from filesystem permissions at all. Check for Deny from all or Require ip directives that may be applying unintentionally.
For more related configuration topics, explore our hosting configuration comparison articles.
Quick Reference Table
| Resource type | Recommended permission | Notes |
|---|---|---|
| Public folders | 755 | Standard on all shared hosting |
| PHP, HTML, CSS, JS files | 644 | Apache can read; no external process can write |
| Sensitive config files | 600 | Owner-read only |
| Scripts with suEXEC/FastCGI | 700 or 600 | Check with your provider |
| Uploads folder (writable) | 755 | Never 777 in production |
If the 403 error persists after fixing permissions, the team at elenlace.com can run a full diagnostic on your hosting environment and resolve it.
Key Takeaways
- A 403 error in cPanel is almost always a permissions issue: 755 for folders, 644 for files is the starting point.
- Permission 777 is a security risk and is actively blocked by many hosts.
- cPanel's File Manager lets you change permissions without SSH access.
- For bulk changes,
find + chmodvia SSH is the most efficient approach. - A 403 can also come from an
.htaccessrule — check for active block directives. - Sensitive files like
wp-config.phpand.envshould be 600, not 644.
Still seeing a 403 after checking permissions? Tell us about your setup at elenlace.com — we'll help diagnose it for free.
FAQ
What permission should the public_html folder have?
The root public_html folder should have permission 750 or 755. With 750, the group can also read and traverse — necessary on some hosts where Apache runs under the user's group. If unsure, start with 755.
Why does uploading a file via FTP change its permissions?
Some FTP clients upload files with the same permissions they have on your local machine, which on Windows are often wrong for Linux servers. Configure your FTP client (FileZilla, WinSCP) to automatically assign 644 to files and 755 to folders on upload.
Are 777 permissions safe for the WordPress uploads folder?
No. Instead of 777, use 755 for the uploads folder and make sure the Apache user (www-data or the PHP-FPM user) is the owner or belongs to the directory's group. Your hosting provider can confirm the right setup for their environment.
How do I check a file's current permission from cPanel?
In cPanel's File Manager, select the file and you'll see its permissions in the "Perms" column, or in the detail panel. You can also right-click → "File Permissions" to view and edit them directly.
Further reading
Other providers and guides worth comparing:
