Hi @farhannaseem, thanks for reaching out to us.
The forbidden error message you’re seeing there is returned by the web server and is unlikely to be a Wordfence block if you’re not seeing a branded Wordfence error page. It is possible that during your site cleaning required WordPress pages or data was removed, or permissions have been altered so that web browsers can no longer see some of the WordPress folders or contents.
We always advise making a full site backup before attempting to clean malware from a site, so it could be restored and retried should anything go wrong. I will provide you with the links and information we normally provide when a customer reports malicious code so that you can see if there are any steps that might help you get your site up and running again.
There is a checklist here:
https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/
Make sure and get all your plugins and themes updated and update WordPress core too. If you are on an older branch (WordPress 4.x etc) because you wanted to wait before installing the latest version because of Gutenberg or a custom theme compatibility you still need the latest update in that version. Those can be found here:
https://www.ads-software.com/download/releases/
WordPress sometimes patches their older releases if they find a vulnerability so make sure to update your version if needed. We, of course, recommend that you update to the latest version.
As a rule, any time I think someone’s site has been compromised I also tell them to update their passwords for their hosting control panel, FTP, WordPress admin users, and database. Make sure and do this.
Additionally you might find the WordPress Malware Removal section in our free Learning Center helpful.
If you are unable to clean this on your own there are paid services that will do it for you. Wordfence offers one and there are others.
Let me know what you find out!
Thanks,
Peter.
