It’s a .htaccess problem.
It is mostly happening on blogs with BulletProof Security plugin. Even if you deactive it, the “secure .htaccess” file it had created stays in place and fully operational.
To FIX this issue (if you are using BPS) activate the plugin, go to the Security Modes tab, check the red “Default Mode WP Default htaccess File” radio button and click on Activate.