HTTP 403 Forbidden

What does HTTP 403 mean?

The server understood the request but refuses to authorize it. The client is known (or authentication would not help) but is not allowed to access the resource. Firewalls, bot protection and wrong file permissions produce 403 too, often with no further explanation.

4xx Client error: The request has a problem the client can fix: wrong URL, missing credentials, bad data or too many requests.

Common causes of a 403 error

• Missing permissions for the logged-in user.
• Web server file permissions (for example a directory without x permission, or chmod 600 on a public file).
• IP blocking, geo-blocking or a WAF/bot-protection rule.
• Directory listing disabled and no index file.

How to fix 403 Forbidden

• Check file and folder permissions — typically 644 for files and 755 for directories.
• Review WAF and bot-protection rules for false positives.
• Add an index.html or enable the correct index file.

How to find the cause of a 403

Start by checking whether the block comes from file permissions or a firewall.

curl -I https://example.com/page
sudo tail -n 20 /var/log/nginx/error.log
namei -l /var/www/site/index.html

A permission denied line in the log points to file or folder permissions, and namei shows which folder is at fault. If your own server logged nothing, the block came earlier, usually from a CDN or firewall such as Cloudflare, so check its security events.

403 and SEO

Google treats 403 like 404 for indexing: the page drops out of results. Blocking Googlebot by mistake with a WAF rule is a common cause of sudden deindexing.

Example response

HTTP/1.1 403 Forbidden

How to return a 403 response

Node.js (Express)

res.status(403).json({ error: 'Forbidden' });

PHP

http_response_code(403);

Python (Flask)

return {'error': 'Forbidden'}, 403

Go (net/http)

w.WriteHeader(403)

nginx

return 403;

Related status codes

• 401 Unauthorized — Authentication is required and has failed or not been provided.
• 404 Not Found — The server cannot find anything at the requested URL.
• 451 Unavailable For Legal Reasons — Access is denied because of a legal demand.
• 429 Too Many Requests — The client sent too many requests in a given amount of time.

Check which status code a URL returns with the HTTP header checker.