HTTP 403 — Forbidden

What 403 actually means

You are known, or your identity is irrelevant, and the answer is still no. Unlike 401, there is no challenge and no invitation to try again with credentials — the server has decided this request is not permitted, full stop. On the public web the two dominant causes are wrong filesystem permissions on the server and a security layer such as a WAF, bot filter or geoblock deciding you should not be here.

Common causes

• File or directory permissions on the server deny read access to the web process
• Directory listing is disabled and there is no index file
• A WAF, bot-protection service or rate-limiting rule blocked the request
• IP allowlisting or country-level geoblocking
• A logged-in user lacks the role needed for that resource
• A signed URL, CDN token or S3 policy has expired or does not grant this action
• Hotlink protection rejecting a request whose `Referer` is another site

If you're just trying to view the page

1. If you should have access, log in — some sites return 403 rather than 401 for signed-out visitors
2. Turn off a VPN or proxy; blocks by IP reputation and by country are common
3. Clear cookies and cache for the site, then reload
4. Try a different network — a shared office or mobile IP that someone else abused can be blocked for everyone on it
5. If it is your own site's admin area, contact whoever manages access rather than retrying

If it's your site

1. Check filesystem permissions and ownership — directories usually need 755 and files 644, owned by or readable to the web server user
2. On Linux with SELinux enforcing, check the file context (`ls -Z`); correct Unix permissions plus a wrong context still yields 403
3. Read the WAF and CDN logs before touching the application; a security rule is more often the cause than the code
4. Check for `deny` rules in `.htaccess`, Nginx `location` blocks, or bucket policies
5. Verify signed-URL expiry and clock sync when using S3, CloudFront or similar
6. Return 404 instead of 403 where merely revealing that a resource exists leaks information

Reference

Status code

403

Reason phrase

Forbidden

Category

4xx — Client Error

Cacheable by default

No

Defined in

RFC 9110 §15.5.4