HTTP 403 Forbidden

What does HTTP 403 mean?

The server understood the request but refuses to authorise it. The client is known (or authentication would not help) but is not allowed to access the resource. Firewalls, bot protection and wrong file permissions produce 403 too, often with no further explanation.

4xx Client error: The request has a problem the client can fix: wrong URL, missing credentials, bad data or too many requests.

Common causes of a 403 error

• Missing permissions for the logged-in user.
• Web server file permissions (for example a directory without x permission, or chmod 600 on a public file).
• IP blocking, geo-blocking or a WAF/bot-protection rule.
• Directory listing disabled and no index file.

How to fix 403 Forbidden

• Check file and folder permissions — typically 644 for files and 755 for directories.
• Review WAF and bot-protection rules for false positives.
• Add an index.html or enable the correct index file.

403 and SEO

Google treats 403 like 404 for indexing: the page drops out of results. Blocking Googlebot by mistake with a WAF rule is a common cause of sudden deindexing.

Example response

HTTP/1.1 403 Forbidden

Related status codes

• 401 Unauthorized — Authentication is required and has failed or not been provided.
• 404 Not Found — The server cannot find anything at the requested URL.
• 451 Unavailable For Legal Reasons — Access is denied because of a legal demand.
• 429 Too Many Requests — The client sent too many requests in a given amount of time.

Check which status code a URL returns with the HTTP header checker.