2026年11月12日

403 Forbidden Only on wp-admin: Causes and Fixes (IP Rules, Plugins, WAF)

Errors & White Screen

This article is a localized edition of the Japanese original. Read the Japanese original

When the public side of your site loads normally but /wp-admin/ or /wp-login.php shows "403 Forbidden", in most cases one of the settings that restrict admin access is rejecting your current connection. This article explains how to tell what is returning the 403 and how to fix each common cause.

Back up your files and database before you start. You will edit configuration files directly, so have FTP, SFTP or your hosting company's file manager ready.

First, find out what is returning the 403

The look of the 403 page and the server's error log tell you roughly where it comes from.

What you see or find in the log	Likely source
A plain page with only "Forbidden" and "You don't have permission to access this resource."	The web server (.htaccess restrictions, file permissions)
A block page that names a plugin such as Wordfence	A security plugin
A page from your hosting company, or a WAF block recorded in its logs	The host's WAF or access restriction features
A Cloudflare page (showing a Ray ID)	Cloudflare firewall rules

If the Apache error log contains AH01630: client denied by server configuration, an access restriction in .htaccess or the server configuration is the cause. If it contains ModSecurity: Access denied with code 403, the WAF (ModSecurity) is blocking you. Where the error log lives depends on the server; on shared hosting you can usually view it from the control panel.

Also check your current IP address. Open a site that shows your IP address in the browser, or run this in a terminal.

curl -s https://ifconfig.me

Cause 1: IP address restrictions in .htaccess

If you protect the admin by allowing wp-login.php only from specific IP addresses, you get a 403 once the IP address of your home or office connection changes. Check both the root .htaccess and wp-admin/.htaccess.

In Apache 2.4 syntax, it looks like this.

# Example: wp-login.php is allowed only from 203.0.113.10
<Files wp-login.php>
    Require ip 203.0.113.10
</Files>

Change the Require ip value to your current IP address, or add more allowed addresses separated by spaces. If you're unsure how to fix it, deleting (or commenting out) the block will let you in for now.

You may also find old Apache 2.2 syntax (Order deny,allow, Deny from all, Allow from …). On Apache 2.4 it works only when the compatibility module (mod_access_compat) is loaded, and mixing it with Require easily produces unexpected results, so rewrite it in the Require ip form shown above.

WordPress core does not ship a .htaccess inside the wp-admin/ folder. If one exists, you or your web developer put it there, so check its contents and remove any restriction you don't recognize.

Cause 2: Blocks by a security plugin

Security plugins such as Wordfence and Solid Security (formerly iThemes Security) block IP addresses with repeated failed logins and requests they consider suspicious. If you block yourself by mistake, you can no longer get into the admin.

Disable the plugin temporarily

Renaming a plugin's folder inside wp-content/plugins/ via FTP or the file manager deactivates that plugin.

wp-content/plugins/wordfence  →  wp-content/plugins/wordfence-off

Once you can get into the admin, rename the folder back, reactivate the plugin on the Plugins screen, and then review its block settings. If you leave the folder renamed, the plugin's protection stays off.

With Wordfence

The Wordfence block page has a form where you enter an administrator's email address to receive an unlock email. It works when you were locked out for too many failed logins.
Once in the admin, check the Blocking tab under Wordfence's Firewall for a block on your IP address and remove it.
To turn off only the Wordfence firewall (WAF), add the following on the line after <?php in wp-config.php. If Wordfence "Extended Protection" is enabled, put it in the same place in wordfence-waf.php in the WordPress root instead. Remove the line once you have found the cause.

<?php
define( 'WFWAF_ENABLED', false );

On a dynamic IP (a connection whose IP address changes from time to time), adding your address to an allowlist stops working the next time it changes. Consider relaxing the failed-login limit or using a static IP or VPN.

Cause 3: The hosting company’s WAF and access restrictions

Many hosting companies offer features that protect the WordPress admin. For example, Xserver, a Japanese hosting company, has a WordPress security settings section that includes a feature restricting admin access from IP addresses outside Japan. If you connect while traveling abroad, or through a VPN or certain cloud services, you can hit this and get a 403.

A host's WAF (ModSecurity and the like) can also mistake requests such as saving a post or changing plugin settings for attacks and return a 403. If you can enter the admin but saving fails with a 403, suspect the WAF.

In both cases, check the settings and the block records in your host's control panel, and temporarily disable the feature or allow your IP address if needed. Don't leave the WAF off; turn it back on when you have finished the operation that triggered it.

Cause 4: A misconfigured Basic authentication

If the admin is behind Basic authentication (a username and password dialog), a wrong password normally returns 401. If you get a 403 instead, the Require lines may be conflicting with other restrictions. This is the basic form of wp-admin/.htaccess (Apache 2.4).

AuthType Basic
AuthName "Restricted Area"
AuthUserFile /home/username/.htpasswd
Require valid-user

# admin-ajax.php is also called from the public side of the site, so exclude it from authentication
<Files admin-ajax.php>
    Require all granted
</Files>

In AuthUserFile, write the location of .htpasswd as a full path on the server starting with /. If the path is wrong, you can't get in even with the correct password. If you don't exclude admin-ajax.php from authentication, features that use it, such as forms and filters on the public side, stop working.

Cause 5: File and folder permissions

If permissions on the wp-admin folder or its files change so the web server can't read them, you get a 403. The usual values are 755 for folders and 644 for files (if your host recommends different values, follow its guidance).

# Check the current permissions and owner
ls -ld wp-admin wp-admin/index.php

# Set folders to 755 and files to 644 (run in the WordPress root)
find wp-admin -type d -exec chmod 755 {} \;
find wp-admin -type f -exec chmod 644 {} \;

If wp-admin/index.php is missing, servers that forbid directory listings also return a 403. In that case, download the WordPress version you run from wordpress.org and upload the wp-admin folder again.

Cause 6: Plugins that change the login URL

If you use a plugin that changes the login URL (such as WPS Hide Login) or the login URL feature of a security plugin, going directly to /wp-admin/ or /wp-login.php may, depending on the settings, return a 404, redirect to the home page or show an error. If you've lost the custom URL, rename that plugin's folder as in Cause 2 to deactivate it, and the standard /wp-login.php comes back. After logging in, rename the folder back, reactivate the plugin, and note the custom URL from its settings screen.

Preventing it from happening again

Restrict the admin by IP address only when your connection's address doesn't change, such as a static IP or a VPN
Keep a note of where you added restrictions (.htaccess, plugins, the host's control panel, Cloudflare) so you can remove them quickly the next time you're locked out
Layering security plugins and server restrictions two or three deep makes the cause hard to find. Decide what each layer does and cut the overlap
Keep the administrator email address set to one you can receive mail at now (it's used for unlock emails and password resets)

Summary

Use the look of the 403 page and the error log (AH01630 or ModSecurity entries) to tell whether the web server, a plugin, the host's WAF or Cloudflare is blocking you
For IP restrictions in .htaccess, update Require ip to your current address or remove the block for now
Temporarily disable a security plugin by renaming its folder, then remove the block and restore it once you're in
For a host's foreign-access restrictions or WAF, check the settings and block records in the control panel
Also check Basic authentication, file permissions and login URL changes

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)