403 Forbidden and 429 Too Many Requests: locked out by the firewall

The short answer

A 403 or 429 error that only you can see usually means the firewall has blocked your connection, not that the site is down. Stop whatever you were doing (repeated logins, a bulk import, a page builder save that kept failing), wait a few minutes, then try again.

If you are still blocked, find your public IP address (search the web for “what is my IP”) and send it to support. They can check what triggered the block and whitelist your address so it does not happen again.

What it means

The numbers are HTTP status codes, the short messages a web server sends back with every page. 403 Forbidden means the server understood the request and refused it. 429 Too Many Requests means you sent more requests in a short window than the server will accept from one address.

In front of your site sits a web application firewall, a filter that inspects traffic before it reaches WordPress and blocks anything that looks like an attack. It watches for patterns such as many failed logins, a flood of page requests in a few seconds, or requests that contain code. When your connection matches one of those patterns, the firewall blocks it for a while. It does not know you are the owner; it only sees the pattern.

The good news is that a firewall block is almost always temporary and almost always limited to your connection. Your customers can usually still see the site. The quickest way to confirm that is to load the site on your phone with Wi-Fi switched off, so it uses the mobile network instead of your office connection.

Common causes

• Repeated failed logins. Mistyping a password several times, a saved password that has since changed, or a browser extension retrying a login in the background. Brute force protection treats this the same way it treats a bot guessing passwords.
• Something on your side is hammering the site. An uptime monitor set to check too often, a backup plugin on another site pulling files, an SEO crawler you started, or a page builder stuck in a save loop.
• Bulk work in the admin. Importing products, uploading a large batch of images, or regenerating thumbnails sends many requests quickly and can look like an attack.
• A shared connection. Offices, co-working spaces and VPNs often put many people behind one IP address. If a colleague (or an infected laptop on the same network) trips the firewall, everyone on that connection is blocked.
• A security plugin inside WordPress. Plugins such as Wordfence or Solid Security keep their own block lists. They can lock you out independently of the hosting firewall, and the error page often looks the same.

How to fix it

1. Confirm it is just you. Load the site on your phone with Wi-Fi off, or ask someone in another location to try. If it works for them, the site is fine and your connection is blocked. (This step is the same on any host.)
2. Stop the trigger. Close extra browser tabs that have the admin open, pause any uptime monitor or crawler you control, and stop any import or bulk upload that was running.
3. Find your public IP address. Search the web for “what is my IP” and copy the result. Support will need it. If you use a VPN, note that too, because the VPN’s address is the one being blocked.
4. Wait, then retry. Most blocks expire on their own. Do not keep refreshing or keep trying to log in while blocked, because every attempt can extend the block.
5. Check the error page for clues. A page that mentions Cloudflare means a Cloudflare rule or rate limit fired. A page that mentions a plugin name means the block is inside WordPress. A plain “403 Forbidden” with no branding usually means the server firewall.
6. If a security plugin locked you out, and you can reach the management console (Plesk with WP Toolkit), open WP Toolkit, find the site, and deactivate the plugin from the Plugins tab. Alternatively, open File Manager, go to wp-content/plugins, and rename the plugin’s folder (for example to wordfence-off). WordPress will deactivate it on the next page load. Log in, clear the block list in the plugin’s settings, then rename the folder back and reactivate.
7. Contact support with the details. Give them your IP address, the time of the block, the address you were trying to reach, and a screenshot of the error. They can see what rule fired and whitelist you.
8. Reduce future triggers. Use a password manager so logins succeed first time, set any uptime monitor to a sensible interval, and run large imports in smaller batches.

On WP Alpha

The WP Alpha firewall blocks repeated requests from the same address, which is what stops password guessing and scraping bots. It will sometimes catch a real owner who has been working hard in the admin. Support can check what triggered the block and whitelist your IP address so you are not caught again.

Every site sits behind a business grade web application firewall with brute force protection, and behind Cloudflare. Support is available on 24/7 live chat, so a lockout at any hour can be sorted out quickly.