Why a page on your preview address shows 403 Forbidden

Your site's free preview address (for example t-1a2b3c4d5e6f.zinnpreview.com) is for building and testing. To keep these addresses safe for every customer, a preview address only runs your application's own files. Anything else that would run code there is refused with 403 Forbidden.

What is refused on a preview address

• WordPress and WooCommerce: PHP runs in wp-admin, wp-includes, wp-content (except

uploads) and in files directly in the site's main folder. A PHP file in uploads, or in a folder you added yourself, is refused.

• Joomla, Drupal, PrestaShop, OpenCart, Grav and MediaWiki: only the application's own

entry points run, such as index.php and its admin folder.

• Static sites and Node.js apps: no PHP runs at all.
• Every site: a few folder and file names used only by phishing kits are refused.

Search engines are also told not to index preview addresses.

Your own domain is not affected

None of this applies when the site is reached on its own domain. If you need code to run from a folder of your own, connect your domain under Domains & DNS. It works there exactly as you wrote it.

Why we do this

Preview addresses share one domain. If anyone used one to host a fake login page, browsers could warn visitors away from every preview address, including yours. Limiting a preview to the application's own files stops that, without touching your real site.

Good to know

• Pages, posts, products, images and styles are never refused. Only code outside the

application's own folders is.

• If something your application genuinely needs is refused on the preview address, contact

support and tell us the address that showed 403.