Maybe check fail2ban or Web Application Firewall "WAF" to see if they are blocking. Also, it seems odd that a document root location would start with a "." as shown in your screenshot....so check to make sure your public and app roots as seen by Plesk are correct. I could be wrong on that...but that looked odd to me.