Error 403 or 406 when saving or uploading

You click Update in WordPress, submit a form or upload a file, and you get 403 Forbidden, 406 Not Acceptable or a blank page. In most cases, a security measure is blocking the request because it looks like an attack. That's annoying, but it can be fixed.

Causes, from most to least common

1. The Web Application Firewall is blocking it

The Web Application Firewall (ModSecurity) checks every request to your website. If what you're saving contains, for example, a snippet of code, a long list of links or certain SQL words, a firewall rule may mistake it for an attack. A 406 is almost always a sign of this.

1. Note the time the error occurred.
2. In DirectAdmin, open Web Application Firewall and click Audit log next to your domain. Find the request around that time: it shows the rule number (the rule ID). You can sometimes also find it in your domain's error log under Site summary & logs, after id (see Web Application Firewall and Site summary & logs: the error log and the access log).
3. In DirectAdmin, open Web Application Firewall and disable just that rule for this domain (see Web Application Firewall).

Please note: Don't turn off the entire firewall. Only disable the rule that's causing the problem. A disabled rule applies to the whole hostname (the domain or subdomain).

2. A security plugin in your website

Plugins such as Wordfence, iThemes Security or All In One WP Security have their own firewall. Check that plugin's logs, or temporarily disable it to test.

3. Incorrect file permissions

Can't the website write to the uploads folder, or is the server not allowed to read a file? That also results in a 403. Folders should be set to 755 and files to 644 (see File and directory permissions (chmod)).

4. Hotlink Protection

Does the 403 only appear for images, for example when they're shown on another site or through a CDN? Then Hotlink Protection may be blocking them. Add the address to the list of allowed addresses (see Hotlink Protection).

5. A protected folder or a rule in .htaccess

A password protected folder (see Password Protected Directories) or rules such as Deny from all in .htaccess also cause a 403. Check File Manager to see if there's a .htaccess file in that folder (see Showing and editing hidden files such as .htaccess).

A 403 on your entire website

Do you get a 403 right on the homepage, with the text You don't have permission to access / on this server? Then there's usually no index.php or index.html in public_html, or your website is in the wrong folder. See Opening File Manager: the directories in your package and A different folder for your website (document root).

No 403, but no connection at all?

Does your website, email and DirectAdmin suddenly stop loading completely from your internet connection, while it works fine over 4G? Then your IP address is probably blocked by the server's firewall. That's different from a 403. Check this with Am I blocked? in the Support Centre of My WebOké (see Solving login problems).

Tip: Can't work it out? Send us a ticket with the time the error occurred, the address of the page and what you were trying to save. We'll look up the rule for you (see Asking for help: what should you tell support?).