403 Forbidden: what it means and how to fix it

The meaning comes from the HTTP specification, RFC 9110: a server that wants to hide that a resource exists may answer 404 instead.

403 Forbidden is the server's way of saying it knows what you asked for and will not give it to you. Browsers and servers word it differently: Forbidden, Access Denied, You don't have permission to access this resource, or a branded page from the site's security provider. The status code is what they share.

Signing in does not always help. A 401 asks for credentials; a 403 says the credentials, the address or the request itself are not allowed, even if they are valid.

1. Check the address. A mistyped path can point at a folder the server will not list.
2. Reload, then clear cookies for the site. A stale session or a broken cookie can be refused.
3. Turn off a VPN or proxy. Shared addresses are sometimes blocked because of what other users of the same address did.
4. Try another network. If it works on mobile data and not at the office, the block is on your network's address, not on you.
5. Contact the site. Give the time, the page and any reference number on the error page: that is what lets the owner find the refusal in their logs.

If the page says your address is on a list, IP blacklist check explains how to see which list and why.

• Permissions. The web server cannot read the file or directory, or directory listing is off and there is no index page.
• Access rules. An allow or deny rule in the server or application configuration matches the request.
• Authentication and roles. The user is signed in but lacks the role the page requires.
• A web application firewall or bot filter. A rule matched something in the request; this is the case behind “blocked by WAF” and “website blocked by firewall”.
• Address and country blocks. A blocklist, a reputation feed or a geographic rule refuses the source.

The fastest way to tell them apart is the log line for the refused request: which component wrote it, and which rule or reason it records.

A WAF in blocking mode refuses requests that match its rules, and many return 403 for that. When it refuses a real customer, the request usually looked like an attack in one detail: code in a support ticket, markup in a comment, an unusual header from an old client.

Find the matching entry in the firewall's log, confirm what matched, and fix it narrowly: an exception for that field or path, not switching the rule off everywhere. False positives covers how to find these requests, and exceptions how to keep each one narrow and dated.

Not every refusal is a 403. The code tells you what kind of refusal it is.

• 401 Unauthorized. Credentials are missing or wrong; signing in may fix it.
• 403 Forbidden. Understood and refused; the request, the user or the source is not allowed.
• 404 Not Found. Sometimes used instead of 403 to hide that a resource exists.
• 429 Too Many Requests. Refused for rate, not content; the same request will work later. See 429 Too Many Requests.
• 503 Service Unavailable. The server cannot handle the request now, often under load; it says nothing about the visitor.