Can't login in my staging env since last full plugins/craft update (still able to in my local env).

I already...

  1. Remove my composer.lock and /vendor files and re-install all components
  2. Rename/delete the /web/cpresources directory
  3. Flush all caches throught CLI command
  4. Try to login in Private mode and other browsers

And still, I got this as a response :

{"error":"Template not found: 403.shtml"}

Here's the trace


Here's the composer.json

    "require": {
        "craftcms/cms": "3.1.31",
        "vlucas/phpdotenv": "^2.4.0",
        "spicyweb/craft-neo": "2.3.5",
        "anubarak/craft-relabel": "1.3.1",
        "ether/seo": "3.5.4",
        "verbb/super-table": "2.1.20",
        "verbb/expanded-singles": "1.0.7",
        "verbb/field-manager": "2.1.0",
        "craftcms/redactor": "",
        "verbb/navigation": "1.1.12",
        "pennebaker/craft-architect": "2.3.1",
        "marionnewlevant/twig-perversion": "2.1.0",
        "clubstudioltd/craft-inline-svg": "v0.1.1",
        "marionnewlevant/snitch": "3.0.0",
        "selvinortiz/patrol": "3.1.3",
        "fruitstudios/linkit": "1.1.11",
        "craftcms/contact-form": "2.2.5",
        "tomodomo/twig-pluralize-extension": "^2.0",
        "verbb/icon-picker": "^1.0",
        "craftcms/element-api": "^2.5"
    "config": {
        "optimize-autoloader": true,
        "platform": {
            "php": "7.2.10"
    "autoload": {
        "psr-4": {
            "modules\\businesslogic\\": "modules/businesslogic/src/"
    "scripts": {
        "post-root-package-install": [
            "@php -r \"file_exists('.env') || copy('.env.example', '.env');\""

EDIT: Apparently this issue happens on all our Craft sites (both 2 and 3) on our server, will update as soon as I found out more

2 Answers 2


Never too late to answer (but fixed weeks ago), apparently our host performed an update on the server that activated several new mod_security rules. One of them was affecting the login.


Template not found: 403.shtml

403.shtml isn't a file that Craft ships with, so most likely it's your web server injecting that into the response of the login POST request for some reason.

Maybe you've got mod_security or Suhosin installed on that server and it's tripping up one of their security rules, for example.

Regardless, it's something you should probably contact your host with as they'll likely be able to help you debug it better.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.