Why does WordPress Site Health say my loopback request returned a 403 error?

A 403 here usually means something is blocking WordPress when it calls back to its own site, not that Site Health is being fussy. WordPress's loopback test POSTs to `wp-cron.php` and expects a 200 response; loopbacks are used for scheduled posts, cron tasks, and some editor safety checks. Start by checking your hosting, firewall/WAF, CDN, and security-plugin logs for that request, then temporarily disable plugins and switch to a default theme to rule out a conflict. If your site uses Basic Auth or a proxy, make sure the loopback request can pass the authentication and reach the right origin. Don't turn off security permanently just to clear the warning. If it still returns 403 with plugins ruled out, your host needs to identify and allow the server-to-self request.