HTTP 403 Forbidden: Why It Happens and How to Fix It

A 403 means the server understood the request and refuses to fulfill it. Unlike a 401, logging in as a different identity may or may not help, because the rule can depend on your IP address, location, user agent or the file system itself. See the HTTP 403 reference.

The error page looks different depending on the layer that produced it. Plain "403 Forbidden" with nginx or Apache at the bottom comes from your web server. A branded page with a Ray ID comes from Cloudflare (see Cloudflare error 1020). A hosting-company or security-plugin page points to a firewall.

If you are a visitor

1. Reload and check the address. A URL ending in a folder name with no index page often returns 403 by design.
2. Log in if the page is for members. Some sites return 403 instead of redirecting.
3. Turn off a VPN or proxy and retry. Shared VPN addresses are often blocked by firewalls. Your public address is shown by What Is My IP.
4. Clear cookies for the site, then try a private window to rule out extensions.
5. Try a different network, such as mobile data. If it works, your IP is blocked.
6. Contact the owner with the URL, the time and your IP address so they can find the block in their logs.

If you own the site

Start by finding who answered. Look at the Server header and any cf-ray or CDN headers with the HTTP Header Checker or CDN Detector, then read that layer's log.

1. File or directory permissions

The web server user (www-data, nginx or apache) must be able to read the file and traverse every parent directory. The error log shows it:

open() "/var/www/site/index.html" failed (13: Permission denied)

Typical fix:

sudo find /var/www/site -type d -exec chmod 755 {} \;
sudo find /var/www/site -type f -exec chmod 644 {} \;
sudo chown -R deploy:www-data /var/www/site
namei -l /var/www/site/index.html   # shows each path component's perms

On SELinux systems, also check context with ls -Z and sudo ausearch -m avc -ts recent.

2. No index file and autoindex off

If a directory has no index.html or index.php, nginx logs directory index of "/path/" is forbidden. Add the file, set index correctly, or enable listing deliberately with autoindex on;. In Apache, Options -Indexes produces the same 403.

3. Access rules in the server config

nginx deny rules and Apache Require directives return 403 on purpose:

location /admin/ {
    allow 203.0.113.0/24;
    deny all;
}

<Directory /var/www/site>
    Require all granted
</Directory>

A missing Require all granted after upgrading to Apache 2.4 is a frequent break; see Apache client denied by server configuration. Also check .htaccess files in every parent folder, since they can override the main config.

4. WAF, security plugin or CDN block

ModSecurity rules, WordPress security plugins, hosting firewalls and CDN rules return 403 for requests that match attack patterns or blocked countries and addresses. Find the matching rule ID in the firewall log (ModSecurity writes to the audit log; Cloudflare shows events in its Security section). Then add a narrow exception for the legitimate request rather than disabling the firewall. Check whether your own server IP is on a list with the Blacklist Checker.

5. Hotlink protection, bots and robots rules

Hotlink protection and bot rules block requests based on Referer or User-Agent. If images fail only on other sites, or your uptime monitor gets 403 while browsers succeed, allow the monitor's user agent or IP. Remember robots.txt does not cause 403s by itself; check yours with the Robots.txt Checker when crawlers report blocks.

Reproduce and confirm

curl -I https://example.com/path
curl -I -A "Mozilla/5.0" https://example.com/path

If the second works and the first does not, a user-agent rule is in play. Run the HTTP Status Checker to see the response from an external location, and the Website Health Check for a broader view. Add an Uptime Monitor so a future permission change on the deploy server alerts you.

Next steps

• Read the HTTP 403 reference.
• Compare with 401 Unauthorized and 404 Not Found.
• Inspect headers with the HTTP Header Checker.
• Review why is my website down for wider diagnosis.

FAQ

Is 403 the same as being banned?

Not necessarily. It may be a permission issue, a missing index or a firewall rule that matches many visitors, not a personal ban.

Why do I see 403 only on some pages?

A rule may target a path, a file type or a certain request pattern. Compare the failing path against your location blocks and .htaccess rules.

Can 403 hurt my rankings?

If Googlebot receives 403 on pages you want indexed, they cannot be crawled. Make sure bot protections allow verified search crawlers.

Should I return 404 instead of 403 for hidden resources?

Some owners do that to avoid confirming a resource exists. It is a choice; use it only where that matters.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.