CloudPanel site shows 403 Forbidden or 404 Not Found: how to fix it
Your site was created, the domain points to the server, but the browser shows 403 Forbidden or 404 Not Found. These are Nginx answering, which is good news: the server works, it just can't find or isn't allowed to show the right file. Here's how to find out why.
Getting 403 in CloudPanel's own File Manager instead? That's a different problem: see CloudPanel File Manager 403 Forbidden. Seeing 502 or 504? See Fix 502 Bad Gateway in CloudPanel.
Step 1: Read the error log
The log usually names the exact problem. As root:
More on logs in CloudPanel logs: find and troubleshoot website errors.
403 Forbidden: the usual causes
1. No index file. The log says. Nginx found the folder, but no or in it, and directory listing is off (as it should be). Upload your files, or check you didn't upload them into an extra sub-folder (a very common mistake when extracting a zip):
2. Wrong Root Directory. Many apps keep their public files in a sub-folder: Laravel uses, Symfony uses , some others use or . In CloudPanel, open the site, go to Settings and set the Root Directory to that folder (for example ).
3. File ownership or permissions. Files uploaded as root, or extracted with odd permissions, can't be read by the site user. The log says. Give the files back to the site user (as root), then let CloudPanel reset permissions to its own defaults (as the site user):
is CloudPanel's built-in command for this; 770/660 are the values from CloudPanel's documentation.
4. You blocked yourself. The site's Security tab can block IPs and bots and add Basic Auth. Check you didn't add your own IP or a whole range. See CloudPanel site security.
404 Not Found: the usual causes
1. Only the home page works, every other page 404s. Classic for WordPress, Laravel and other apps with "pretty" URLs. On Apache those rules live in, but Nginx ignores .htaccess files completely. The rules must be in the site's vhost. The fix is usually to use the right vhost template for your app: when you create a PHP site, CloudPanel lets you pick an application (WordPress, Laravel and many more) and sets up the right rules. For an existing site, compare the site's Vhost tab with a fresh site of the right type and look for the line, for example:
Edit the vhost carefully; a typo can take the site down. Save a copy of the old version first.
2. Files in the wrong place. Same as the 403 case: check output and the Root Directory.
3. Upper and lower case. Linux file names are case-sensitive: and are different files. Sites moved from Windows hosting often break here.
4. The domain shows a different site. If you see another site's 404, the request isn't reaching the vhost you think. Check the domain spelling and the variant in the site's settings and vhost ( line), and that DNS points to this server: .
After every change
Clear your browser cache or test in a private window, and if the site uses Varnish, purge the cache (site > Varnish Cache > Purge). Cached 404s are a common reason a fix "didn't work".
Still stuck? Post the error log lines (hide your domain if you prefer) and which app you run.
Sources: Nginx: try_files · CloudPanel documentation
More CloudPanel troubleshooting
Applies to CloudPanel v2 on Ubuntu and Debian, October 2026. In the commands, replace with your domain and with your site's user name (shown on the site's Settings page).
Your site was created, the domain points to the server, but the browser shows 403 Forbidden or 404 Not Found. These are Nginx answering, which is good news: the server works, it just can't find or isn't allowed to show the right file. Here's how to find out why.
Getting 403 in CloudPanel's own File Manager instead? That's a different problem: see CloudPanel File Manager 403 Forbidden. Seeing 502 or 504? See Fix 502 Bad Gateway in CloudPanel.
Step 1: Read the error log
The log usually names the exact problem. As root:
Code:
tail -n 30 /home/siteuser/logs/nginx/error.log403 Forbidden: the usual causes
1. No index file. The log says
Code:
directory index of "/home/.../htdocs/example.com/" is forbiddenCode:
index.phpCode:
index.htmlCode:
ls -la /home/siteuser/htdocs/example.com/2. Wrong Root Directory. Many apps keep their public files in a sub-folder: Laravel uses
Code:
publicCode:
publicCode:
webCode:
pubCode:
example.com/public3. File ownership or permissions. Files uploaded as root, or extracted with odd permissions, can't be read by the site user. The log says
Code:
Permission deniedCode:
chown -R siteuser:siteuser /home/siteuser/htdocs/example.com
su - siteuser
cd ~/htdocs/example.com
clpctl system:permissions:reset --directories=770 --files=660 --path=.Code:
clpctl system:permissions:reset4. You blocked yourself. The site's Security tab can block IPs and bots and add Basic Auth. Check you didn't add your own IP or a whole range. See CloudPanel site security.
404 Not Found: the usual causes
1. Only the home page works, every other page 404s. Classic for WordPress, Laravel and other apps with "pretty" URLs. On Apache those rules live in
Code:
.htaccessCode:
try_filesCode:
location / {
try_files $uri $uri/ /index.php?$args;
}2. Files in the wrong place. Same as the 403 case: check
Code:
ls3. Upper and lower case. Linux file names are case-sensitive:
Code:
Logo.pngCode:
logo.png4. The domain shows a different site. If you see another site's 404, the request isn't reaching the vhost you think. Check the domain spelling and the
Code:
wwwCode:
server_nameCode:
dig +short A example.comAfter every change
Clear your browser cache or test in a private window, and if the site uses Varnish, purge the cache (site > Varnish Cache > Purge). Cached 404s are a common reason a fix "didn't work".
Still stuck? Post the error log lines (hide your domain if you prefer) and which app you run.
Sources: Nginx: try_files · CloudPanel documentation
More CloudPanel troubleshooting
- Installation failed: common install errors
- Can't log in: port 8443, password and 2FA
- Too many redirects or mixed content after SSL
- PHP extension missing / enable ionCube
- WordPress asks for FTP or can't update plugins
- Varnish showing old pages or breaking logins
- Restore a site from a backup
- SSH or SFTP login fails
- Node.js app shows 502 or keeps restarting
- Site hacked: find malware and clean up
- clpctl errors: not found, wrong user, quoting
Applies to CloudPanel v2 on Ubuntu and Debian, October 2026. In the commands, replace
Code:
example.comCode:
siteuser
