Diagnosing 403 Forbidden Errors
Understanding 403 Forbidden Errors
A 403 error means the server understood the request but refuses to authorize it. On BlitzPress (OpenLiteSpeed), common causes include the 7G WAF rules, incorrect file permissions, IP blocks, and missing index files.
Check the 7G Web Application Firewall
BlitzPress uses the 7G WAF ruleset to block malicious requests. Sometimes legitimate requests get caught. Check if a request is being blocked:
grep "403" /home/YOUR_DOMAIN/logs/access.log | tail -20If the blocked request contains a query string or path that matches a 7G rule (e.g., eval(, base64, union select), you can whitelist it in your OLS vhost configuration.
File Permissions
WordPress requires specific file permissions to function correctly:
| Type | Permission | Command |
|---|---|---|
| Directories | 755 | find /home/DOMAIN/public_html -type d -exec chmod 755 {} \; |
| Files | 644 | find /home/DOMAIN/public_html -type f -exec chmod 644 {} \; |
| wp-config.php | 640 | chmod 640 /home/DOMAIN/public_html/wp-config.php |
On OLS, the web server runs as nobody:nogroup. Ensure files are owned by the correct user and readable by nobody.
Directory Index Missing
If a directory lacks an index.php or index.html file and directory listing is disabled (which it should be), OLS returns 403. Ensure your WordPress installation has index.php in the webroot.
IP-Based Blocks
Check if your IP is blocked by fail2ban or OLS access control:
sudo fail2ban-client status
sudo fail2ban-client status sshdTo unban an IP:
sudo fail2ban-client set sshd unbanip YOUR_IPOLS Context-Level Access Control
Unlike Apache’s .htaccess, OLS uses context blocks in vhconf.conf to control access. Check if a context block is denying access to the path you are trying to reach.