nginx 'directory index of "/path/" is forbidden' (403) Fix

The browser shows "403 Forbidden" with nginx at the bottom, and the error log says:

[error] 812#812: *3 directory index of "/var/www/example.com/" is forbidden, client: 203.0.113.9, server: example.com, request: "GET / HTTP/1.1", host: "example.com"

nginx received a request for a directory (usually /). It looked for an index file, found none, and because directory listings are off by default it refuses instead of showing the folder contents. The message is not about file permissions. It states that no index file matched and autoindex is not enabled.

The path in the log is your best clue. Compare it with where your files really are.

Step 1: is the root path correct?

Check the directory in the log line:

ls -la /var/www/example.com/

If it is empty or does not contain your site, the problem is the root directive, a failed deploy, a build step that wrote to a different folder (dist/, public/, build/), or a vhost that is not the one you think is answering. Print the effective config:

sudo nginx -T | grep -n -E "server_name|root|index"

Fix root so it points at the folder that holds index.html (or index.php).

Step 2: does the index file exist with the expected name?

By default nginx tries index.html. If your entry file is named differently, say so:

server {
    server_name example.com;
    root /var/www/example.com/public;
    index index.php index.html;
}

Names are tried in order. Remember that file names are case sensitive on Linux, so Index.html is not index.html. If you serve PHP, the index line must come with a working location ~ \.php$ block; otherwise the request will fall through and may still end in this error.

Step 3: a try_files that ends at a directory

A common source is a front-controller rule like:

location / {
    try_files $uri $uri/ =404;
}

With $uri/ in the list, a request for /docs that matches a real directory makes nginx look for an index inside it. If none exists, you get this 403 rather than a 404. For single-page apps and frameworks, send unknown paths to the entry file instead:

location / {
    try_files $uri $uri/ /index.html;
}

For a PHP framework use /index.php?$query_string as the fallback. If that fallback file itself is missing, you will see the separate rewrite or internal redirection cycle error.

Step 4: decide whether you want listings

If the folder is meant to show a file list (a downloads area, an artifact mirror), enable it deliberately, scoped to one location:

location /downloads/ {
    autoindex on;
    autoindex_exact_size off;
    autoindex_localtime on;
}

Do not enable autoindex globally. It can expose backups, config files and source code that happen to live in the web root.

Step 5: still 403 after adding the index

If the file exists and the error changes to open() "..." failed (13: Permission denied), you have moved on to a permissions problem. The nginx worker user needs execute on every parent directory and read on the file. That is covered in nginx permission denied (13) and the broader nginx 403 Forbidden fix. On RHEL-family systems also check SELinux labels.

Step 6: is the right server block handling the request?

If root looks correct in one block but the log path points elsewhere, nginx picked another server. The default site shipped with the package (/etc/nginx/sites-enabled/default or conf.d/default.conf) often catches requests when server_name does not match the Host header. Remove the default site or make sure your server_name matches, then:

sudo nginx -t && sudo systemctl reload nginx
curl -I -H "Host: example.com" http://127.0.0.1/

How to verify

After the change, request the root URL and a deep link and confirm 200 with the HTTP स्टेटस चेकर. Use the HTTP Header Checker to confirm the Content-Type is text/html and not a download. If the page loads but assets 404, move on to nginx 404 for existing files. An अपटाइम मॉनिटर on the home page will catch an empty deploy directory next time, because it will see the 403 immediately.

अगले कदम

• Read nginx 403 Forbidden fix.
• Fix nginx 404 for existing files.
• See the HTTP 403 reference.
• Compare servers in Apache vs nginx troubleshooting.

सामान्य प्रश्न

Is this a permission problem?

No, not by itself. It means no index file matched and autoindex is off. Permission problems log Permission denied (13) instead.

Why did it start after a deploy?

The deploy probably emptied or replaced the web root, or the build output moved to a new subfolder. Check that index.html is where root expects it.

Should I turn on autoindex to fix it?

Only if you want a public file listing. For a normal site, fix the missing index file or the root path instead.

Why a 403 and not a 404?

nginx found a real directory but is not allowed to list it, so it answers Forbidden. A missing path returns 404.

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.