403 Forbidden When Updating PHP Code: How to Fix File Permissions Safely

Quick Answer

If Hostinger File Manager shows 403 Forbidden when you try to save changes to a PHP file, check the file's permissions. A permission value of 444 (r--r--r--) makes the file read-only for the owner, group and everyone else. Change the individual PHP file to 644 (rw-r--r--) so the owner can read and write it while the group and others retain read-only access. Do not use 777 as a shortcut because it gives unnecessary write and execute permissions to everyone.

Complete Article

You may be able to open and read a PHP file in your hosting control panel but receive a 403 Forbidden message as soon as you try to save edited code. This can look like a PHP syntax problem or a hosting security block, but the actual cause may be much simpler: the file is read-only.

This commonly happens when a file such as index.php has permission 444, displayed symbolically as r--r--r--. Because no user class has write permission, the online editor cannot update the file. Changing the file to 644, displayed as rw-r--r--, normally restores editing while keeping a sensible security boundary.

Hostinger provides permission controls in hPanel File Manager and through FTP. Its documentation also provides a Fix File Ownership option when the ownership of several files or folders is incorrect. See Hostinger's official guides for setting access rights and fixing file permissions or ownership.

Why a PHP File Becomes Read-Only

Web hosting systems based on Linux use permission bits to control who can read, modify or execute a file. Permissions are divided among three classes:

• Owner: The hosting account or user that owns the file.

• Group: Other users or services belonging to the file's assigned group.

• Others: Everyone else who is not the owner or part of the group.

Each class can receive one or more permissions:

Permission	Letter	Numeric value	Purpose
Read	r	4	View the file's contents
Write	w	2	Modify or overwrite the file
Execute	x	1	Execute a file or traverse a directory

The owner, group and other permission bits are part of the standard Unix file-access model. POSIX defines separate read, write and execute/search permissions for each class. POSIX file mode definitions

What Does Permission 444 Mean?

Permission 444 means:

Class	Permission	Symbolic form
Owner	Read only	r--
Group	Read only	r--
Others	Read only	r--

Combined, it appears as:

r--r--r--

The web server may still be able to read and serve the PHP file, so the website might continue to open normally. However, the hosting file editor cannot save changes because the owner does not have write permission.

This creates a useful diagnostic clue: if the PHP page works but saving the file generates a 403 or permission-denied response, check the file permission and ownership before changing the PHP code.

What Does Permission 644 Mean?

Permission 644 means:

Class	Permission	Symbolic form
Owner	Read and write	rw-
Group	Read only	r--
Others	Read only	r--

Combined, it appears as:

rw-r--r--

For a normal PHP source file on shared hosting, 644 is a commonly used setting. It lets the owner edit the file without granting write access to the group or the public. Hostinger also uses 644 as the normal file value in its permission-repair guidance, while directories commonly use 755.

How to Fix 403 Forbidden While Saving PHP in Hostinger

Step 1: Back Up the File

Before changing permissions or code, download the current PHP file or create a copy with a clear name such as:

index-backup.php

Keep the backup only as long as needed. A publicly accessible backup PHP page can create duplicate content or expose outdated application behavior, so remove it from the public directory after verifying the repair.

Step 2: Open Hostinger File Manager

1. Sign in to Hostinger hPanel.

2. Open Websites.

3. Select Dashboard for the relevant website.

4. Go to Files → File Manager.

5. Open the site's document root, normally public_html.

6. Locate the PHP file that cannot be saved, such as index.php.

Hostinger's File Manager supports opening and editing text-based files, including PHP files. Hostinger File Manager actions

Step 3: Check the Existing Permission

Right-click the PHP file and select Permissions. If the value is 444, or the interface shows only Read selected for Owner, Group and Others, the file is read-only.

Do not confuse file permissions with folder permissions. A PHP file normally does not need execute permission merely because it contains executable PHP code. The web server invokes the PHP handler; it does not usually execute the source file as a standalone program.

Step 4: Change the PHP File to 644

Set the checkboxes as follows:

Class	Read	Write	Execute
Owner	Yes	Yes	No
Group	Yes	No	No
Others	Yes	No	No

The result should be:

rw-r--r--

or numerically:

644

Save the permission change, reopen the file editor, make the PHP change and save again.

Step 5: Test the Website

Open the affected page in a new browser tab and confirm that it loads correctly. Use Ctrl + F5 on Windows to force a fresh browser reload. If the website uses a CDN, server cache or application cache, purge only the relevant cache after confirming that the file was saved successfully.

Also confirm that:

• The expected code appears in File Manager after reopening the file.

• The page does not display a PHP parse error or HTTP 500 error.

• Links, forms and database-driven sections still work.

• The permission remains 644 after saving.

Alternative Ways to Change the Permission

Using FTP or SFTP

If hPanel File Manager cannot update the permission:

1. Connect using an FTP client such as FileZilla, or use SFTP when available.

2. Locate the file inside public_html.

3. Right-click it and open File permissions or File attributes.

4. Enter 644.

5. Apply the change to that file only.

Hostinger documents changing permissions through both hPanel and an FTP client. Avoid applying a file permission recursively to directories, because files and directories normally require different values.

Using SSH

If SSH access is enabled, change one specific file with:

chmod 644 public_html/index.php

Check the result with:

ls -l public_html/index.php

The permission portion should resemble:

-rw-r--r--

Confirm the path before running the command. Do not run a broad recursive chmod command unless you fully understand which files and directories it will affect.

What If Permission 644 Does Not Fix the Error?

The permission bits are only one part of access control. If the file already has 644 but the editor still cannot save it, investigate the following areas.

1. Incorrect File Ownership

A file can show 644 while being owned by the wrong hosting user. In that situation, the account operating File Manager may still lack owner-level write access.

In Hostinger hPanel, go to the website dashboard and look under Advanced → Fix File Ownership. Follow Hostinger's confirmation process to reset files and folders to the account's expected ownership and default permissions. Use this broader repair only when ownership or multiple permissions are wrong; for one read-only file, changing that individual file is more controlled.

2. Expired hPanel Session

If the permission is correct but File Manager suddenly returns 403, sign out of hPanel, sign in again and retry. An expired administrative session can prevent an otherwise valid save request.

3. Security Rule or Web Application Firewall

A hosting security layer may reject a save request that matches a protection rule. First confirm permissions and ownership. If they are correct and the rejection happens only with particular code, keep a copy of the exact time and request details and contact Hostinger support. Do not permanently disable website protection simply to bypass an unexplained error.

4. Incorrect Directory Permissions

Directories need execute/search permission so the web server and hosting tools can traverse them. A common directory setting is 755, displayed as rwxr-xr-x. Setting a directory to 644 can make its contents inaccessible even though 644 is appropriate for ordinary files.

5. Restrictive .htaccess Rules

If visitors receive 403 when opening the website—not only when an administrator saves a file—review .htaccess rules for denied paths, IP restrictions or authorization requirements. Back up .htaccess before changing it, and restore the previous version if a test makes the site unavailable.

Save-Time 403 vs Website 403

The point at which the error appears helps narrow the cause:

Symptom	Likely area to check first
Website works, but File Manager cannot save index.php	File permission, ownership or hPanel session
Website itself displays 403	Directory access, .htaccess, ownership or hosting security rules
File saves, but page displays HTTP 500	PHP syntax, runtime error or server configuration
File saves, but old content remains visible	Browser, CDN, server or application cache
FTP upload works, but online editor fails	hPanel session or editor security control

This distinction prevents unnecessary changes to working PHP or database code.

Common Mistakes to Avoid

Setting the File to 777

Permission 777 grants read, write and execute access to the owner, group and others. It is not an appropriate general solution for a PHP file and creates unnecessary security exposure. Use the least permission required for the task.

Applying 644 to Folders

Files and folders use the same permission notation but require different access patterns. Ordinary website files commonly use 644, while directories commonly use 755 so they can be traversed.

Applying Permissions Recursively Without Checking

A recursive change can modify every file and directory beneath public_html. Applying one value to both types may break the website. Change only the affected file when the problem is limited to one file.

Editing Without a Backup

Correct permissions allow saving, but they do not protect against an accidental code error. Keep a known-good copy before editing production PHP files.

Assuming Every 403 Has the Same Cause

HTTP 403 generally means access was refused, but the responsible layer can be File Manager, the web server, a security service or a permissions system. Always note where the message appears and what action triggers it.

Recommended Permission Checklist for PHP Websites

• Use 644 for ordinary PHP, HTML, CSS and JavaScript files unless the hosting provider specifies otherwise.

• Use 755 for ordinary website directories unless the hosting provider specifies otherwise.

• Give write permission only where the application genuinely needs it, such as specific upload or cache locations.

• Avoid 777 permissions.

• Keep configuration files containing credentials as restrictive as the application and hosting environment allow.

• Confirm ownership when correct-looking permissions still do not permit editing.

• Back up files before changing production code.

• Test the affected page immediately after saving.

• Remove temporary public backup files after validation.

Frequently Asked Questions

1. Why did Hostinger show 403 when I tried to save PHP code?

If the file was set to 444, it was read-only. The hosting editor could display the file but could not write the edited contents back to it.

2. What does r--r--r-- mean?

It means the owner, group and others can read the file, but none of them has write or execute permission. Its numeric representation is 444.

3. What does rw-r--r-- mean?

It means the owner can read and write the file, while the group and others can only read it. Its numeric representation is 644.

4. Is 644 safe for an index.php file?

On typical shared hosting, 644 is a commonly used permission for ordinary PHP files. Follow any more specific requirement supplied by your hosting provider or application.

5. Does a PHP file need execute permission?

Normally, no. The web server passes the PHP source to a PHP handler or runtime. The file itself usually needs to be readable, not marked as a standalone executable.

6. Should I change all PHP files to 644?

Only change files that have incorrect permissions, unless the hosting provider's repair tool identifies a broader problem. Sensitive configuration files may intentionally use more restrictive permissions.

7. Why should I not use 777?

777 allows everyone to modify and execute the item. This grants far more access than an ordinary PHP file requires and can increase the impact of a compromised account or vulnerable application.

8. What permissions should folders use?

Website folders commonly use 755, which allows the owner to manage the directory and permits other users or services to traverse and read it. Do not automatically apply the file value 644 to directories.

9. Can I change file permissions using FileZilla?

Yes. Right-click the remote file, choose File permissions or File attributes, enter 644, and apply the change to the selected file.

10. What command changes a PHP file to 644 over SSH?

Use chmod 644 followed by the verified path, for example chmod 644 public_html/index.php.

11. Why can I edit some PHP files but not index.php?

Individual files can have different permissions or ownership. Check the affected file itself instead of assuming every file in the directory uses the same settings.

12. What if the permission returns to 444 automatically?

A deployment script, security tool, backup restoration process or account policy may be resetting it. Review recent automated tasks and contact the hosting provider if you cannot identify the process.

13. Will changing from 444 to 644 make the website public?

No. Both settings allow public read access at the filesystem level when the server maps the request appropriately. The difference is that 644 adds write permission for the file owner; website visibility is also governed by the web server and application.

14. Why does the website still show old content after the file saves?

The browser, a CDN, the hosting platform or the application may be serving cached content. First reopen the file to confirm the change was saved, then use a hard refresh and clear only the relevant cache.

15. When should I use Hostinger's Fix File Ownership option?

Use it when several files have incorrect ownership or when 644 still does not allow the hosting account to edit files. For one file set to 444, changing that file alone is the more targeted first step.

Final Recommendation / Conclusion

When a hosting file editor returns 403 Forbidden while saving PHP code, check the affected file before modifying PHP, .htaccess or security settings. A file set to 444 (r--r--r--) is read-only and cannot be updated by its owner. Changing that individual file to 644 (rw-r--r--) restores owner write access while keeping group and public access read-only.

Use 644 for an ordinary PHP file only when it matches your host's requirements, retain 755 for ordinary directories, verify ownership when permissions appear correct, and never use 777 as a routine fix. A backup, a targeted permission change and an immediate website test provide the safest recovery path.

 

#403Forbidden #PHP #PHPError #PHPFilePermissions #Hostinger #HostingerHosting #HostingerFileManager #hPanel #FilePermissions #CHMOD #CHMOD644 #CHMOD444 #LinuxPermissions #IndexPHP #PublicHTML #WebsiteError #WebsiteTroubleshooting #WebHosting #SharedHosting #PermissionDenied #ReadOnlyFile #FileOwnership #WebsiteSecurity #PHPDevelopment #WebDevelopment #FTP #SFTP #SSH #HostingSupport #BisonInfosolutions