Getting Random 403 Errors on My Site — Running Out of Ideas

[lousa]

I've been dealing with recurring 403 Forbidden errors on my site, and I can't seem to pin down the cause.

The strange part is that it isn't consistently happening on every page. Some requests work normally while others suddenly return a 403, and it can sometimes disappear and come back later.

I've already checked the obvious stuff — file permissions, .htaccess, caching, and the usual WordPress settings — but I'm still missing something.

The site is behind a CDN/security layer as well, so I'm wondering if this could be a firewall or WAF rule rather than an actual server permission problem.

If anyone has dealt with persistent or intermittent 403s like this, I'd appreciate hearing what eventually turned out to be the cause. I'm happy to provide logs or configuration details if needed.

[plsureking]

its probably you not the site. 403 means you (the visitor) are blocked from the server.

if you are pulling content from another server, make sure your site/IP isn't blocked there.

its likely you tho. try a different vpn.

#

[2MuchMark]

I've been dealing with recurring 403 Forbidden errors on my site, and I can't seem to pin down the cause.

The strange part is that it isn't consistently happening on every page. Some requests work normally while others suddenly return a 403, and it can sometimes disappear and come back later.

I've already checked the obvious stuff — file permissions, .htaccess, caching, and the usual WordPress settings — but I'm still missing something.

The site is behind a CDN/security layer as well, so I'm wondering if this could be a firewall or WAF rule rather than an actual server permission problem.

If anyone has dealt with persistent or intermittent 403s like this, I'd appreciate hearing what eventually turned out to be the cause. I'm happy to provide logs or configuration details if needed.

Hi Lousa,

This probably isn't a file-permissions problem, so I wouldn't loosen anything yet.

A quick view of your site shows me what looks to be a Jetpack/XML-RPC conflict at the origin, although that may be separate from the intermittent page 403s.

The next time it happens, save the exact URL, time and CF-RAY and then send it to me at [email protected]. That should quickly tell me whether Cloudflare or your server caused it.

Contact me if you'd like more details or assistance.

Mark Prince
https://2much.net

[V_RocKs]

How often? Do you and others at your place of work share an IP address and work on the site at the same time?

Have you checked your apache logs?

Can you tell by the 403 if it is truly generic from the server, has Cloudflare information like a Ray ID, or looks like WP is making it?

[V_RocKs]

How often? Do you and others at your place of work share an IP address and work on the site at the same time?

Have you checked your apache logs?

Can you tell by the 403 if it is truly generic from the server, has Cloudflare information like a Ray ID, or looks like WP is making it?

[Publisher Bucks]

The issue is probably because the 90s are trying to get the design back.

[2MuchMark]

V_RocKs is asking the right questions... One thing to know: Cloudflare adds a CF-RAY header even when the origin server generated the error, so its presence alone doesn’t tell you the source.

Lousa: The next time it happens, save the exact URL, time, screenshot and response headers. Then check that Ray ID in Cloudflare Security Events and the same request in your Nginx/Apache logs from your host. That'll show you whether if the 403 error is being thrown from Wordpress, or something else on your site, or Cloudflare, or your server.

[V_RocKs]

V_RocKs is asking the right questions... One thing to know: Cloudflare adds a CF-RAY header even when the origin server generated the error, so its presence alone doesn’t tell you the source.

Lousa: The next time it happens, save the exact URL, time, screenshot and response headers. Then check that Ray ID in Cloudflare Security Events and the same request in your Nginx/Apache logs from your host. That'll show you whether if the 403 error is being thrown from Wordpress, or something else on your site, or Cloudflare, or your server.

Hahahaha... Who would have thought we'd be offering admin services for free at a time when GFY is on life support?

Shit... are we life support? Should we register as first responders?