Common causes
- The DocumentRoot is outside /var/www and has no <Directory> block with Require all granted (the default config denies /)
- Old Apache 2.2 syntax (Order deny,allow / Deny from all) mixed with Apache 2.4 Require directives
- Require ip or Require host rules that do not include the client's IP, often behind a proxy or Cloudflare
- A <Files> or <FilesMatch> block denying .php, .env or other patterns that matches more than intended
- Aliases (phpMyAdmin, /.well-known) pointing to folders without their own access rules
- Security plugins writing Require all denied into .htaccess in a parent or uploads folder
How to fix it
- Read the full log line. The path at the end of the AH01630 message shows exactly which folder or file was denied. Check the configs and .htaccess files on that path.
- Grant access to the DocumentRoot. Add a <Directory> block for your site's real path with Require all granted, then run apachectl configtest and reload.
- Replace Apache 2.2 access syntax. Convert Order allow,deny / Allow from all to Require all granted, and Deny from all to Require all denied. Avoid mixing old and new styles in the same scope.
- Fix IP-based rules behind a proxy. If Require ip rules apply and you use Cloudflare or a load balancer, enable mod_remoteip with the proxy ranges so Apache sees the real client IP.
- Check Files and FilesMatch blocks. Make sure deny patterns target only sensitive files such as \.env$ or wp-config\.php$ and not all PHP files.
Apache 2.4 vhost
<VirtualHost *:80>
ServerName example.com
DocumentRoot /srv/sites/example.com/public
<Directory /srv/sites/example.com/public>
AllowOverride All
Require all granted
</Directory>
<FilesMatch "^\.env$">
Require all denied
</FilesMatch>
</VirtualHost>How to stop it happening again
- Use only Apache 2.4 Require syntax in new configs and .htaccess
- Add a matching <Directory> block whenever you change DocumentRoot or add an Alias
- Review security plugin rules after updates