403 Forbidden

What it means

Unlike 401, logging in will not help; the identity is known but lacks permission, or the server blocks the request entirely.

Common causes

• File or directory permissions deny access.
• A firewall, WAF, or bot protection blocked the request.
• IP address or country restrictions.

How to fix it

1. Check file permissions and server access rules.
2. Review WAF or CDN security rules for false positives.
3. Confirm the account has the required role.

Example response

HTTP/1.1 403 Forbidden
Content-Type: text/plain; charset=utf-8

Worked example

A signed-in user requests an admin-only resource and receives 403. Repeating the request with the same credentials will not grant access; an administrator must change the account role or resource policy.

How to read this response

1. Find the status line in your browser's Network panel, API client, or server access log.
2. Read the response body and headers shown above; headers such as Location, Allow, Retry-After, and WWW-Authenticate explain the next step.
3. Use the code's class to orient your diagnosis: informational, successful, redirected, request-related, or server-side.

SEO impact

If crawlers receive 403, pages drop out of search results. Make sure bot protection allows verified search engine crawlers.

How to check a status code

Enter a URL in the HTTP Status Checker to see its status code, every redirect hop, and response time. For redirect-heavy pages, the Website Speed Test shows how much time redirects add.

Frequently asked questions

What it means: HTTP 403

403 Forbidden: The server understood the request but refuses to allow it.

Common causes: 403

File or directory permissions deny access. A firewall, WAF, or bot protection blocked the request. IP address or country restrictions.

How to fix it: HTTP 403

Check file permissions and server access rules. Review WAF or CDN security rules for false positives. Confirm the account has the required role.

Tools