---
title: "403 Forbidden — what it means and how to fix it"
description: "The server understood the request and is refusing to allow it, and logging in will not help. What causes an HTTP 403, what to try as a visitor, and what to check if it is your own site."
url: https://atoneplace.net/error/403/
site: "At One Place"
---

# HTTP 403 — Forbidden

**HTTP 403: Forbidden**

The server understood the request and is refusing to allow it, and logging in will not help.

## What 403 actually means

You are known, or your identity is irrelevant, and the answer is still no. Unlike 401, there is no challenge and no invitation to try again with credentials — the server has decided this request is not permitted, full stop. On the public web the two dominant causes are wrong filesystem permissions on the server and a security layer such as a WAF, bot filter or geoblock deciding you should not be here.

## Common causes

- File or directory permissions on the server deny read access to the web process
- Directory listing is disabled and there is no index file
- A WAF, bot-protection service or rate-limiting rule blocked the request
- IP allowlisting or country-level geoblocking
- A logged-in user lacks the role needed for that resource
- A signed URL, CDN token or S3 policy has expired or does not grant this action
- Hotlink protection rejecting a request whose `Referer` is another site

## If you're just trying to view the page

1. If you should have access, log in — some sites return 403 rather than 401 for signed-out visitors
2. Turn off a VPN or proxy; blocks by IP reputation and by country are common
3. Clear cookies and cache for the site, then reload
4. Try a different network — a shared office or mobile IP that someone else abused can be blocked for everyone on it
5. If it is your own site's admin area, contact whoever manages access rather than retrying

## If it's your site

1. Check filesystem permissions and ownership — directories usually need 755 and files 644, owned by or readable to the web server user
2. On Linux with SELinux enforcing, check the file context (`ls -Z`); correct Unix permissions plus a wrong context still yields 403
3. Read the WAF and CDN logs before touching the application; a security rule is more often the cause than the code
4. Check for `deny` rules in `.htaccess`, Nginx `location` blocks, or bucket policies
5. Verify signed-URL expiry and clock sync when using S3, CloudFront or similar
6. Return 404 instead of 403 where merely revealing that a resource exists leaks information

## Reference

- **Status code:** 403
- **Reason phrase:** Forbidden
- **Category:** 4xx — Client Error
- **Cacheable by default:** No
- **Defined in:** RFC 9110 §15.5.4

## Common questions

### What does HTTP 403 mean?

The server understood the request and is refusing to allow it, and logging in will not help. You are known, or your identity is irrelevant, and the answer is still no. Unlike 401, there is no challenge and no invitation to try again with credentials — the server has decided this request is not permitted, full stop.

### How do I fix a 403 error?

If you should have access, log in — some sites return 403 rather than 401 for signed-out visitors

### Is 403 a client error or a server error?

403 is in the 4xx range, which means client error. The request itself was the problem, so retrying it unchanged will usually return the same code.

## Related pages

- [404 Not Found](https://atoneplace.net/error/404/)
- [401 Unauthorized](https://atoneplace.net/error/401/)
- [429 Too Many Requests](https://atoneplace.net/error/429/)
- [400 Bad Request](https://atoneplace.net/error/400/)
- [413 Content Too Large](https://atoneplace.net/error/413/)
- [422 Unprocessable Content](https://atoneplace.net/error/422/)
- [405 Method Not Allowed](https://atoneplace.net/error/405/)
- [409 Conflict](https://atoneplace.net/error/409/)
- [415 Unsupported Media Type](https://atoneplace.net/error/415/)
- [408 Request Timeout](https://atoneplace.net/error/408/)
- [410 Gone](https://atoneplace.net/error/410/)
- [451 Unavailable For Legal Reasons](https://atoneplace.net/error/451/)

## Sources

- Hypertext Transfer Protocol (HTTP) Status Code Registry — IANA (https://www.iana.org/assignments/http-status-codes/)
- RFC 9110: HTTP Semantics — IETF (https://www.rfc-editor.org/rfc/rfc9110.html)