Runs in your browser. Your files and text never leave your device - nothing is uploaded.
4xx Client Error
What it means
The server understood the request but refuses to fulfil it, for example because the account lacks permission or a rule blocks the request.
| Property | Detail |
|---|---|
| Status class | 4xx Client Error |
| Defined in | RFC 9110, Section 15.5.4 |
| Cacheable by default | Only with explicit caching headers: a cache stores it when the response carries Cache-Control (max-age, s-maxage or public) or Expires. |
| Who needs to act | Usually the site owner or administrator; sometimes the user's account permissions. |
What does HTTP 403 Forbidden mean?
HTTP 403 Forbidden means the server understood the request and refuses to fulfil it. Unlike 401, sending the same credentials again will not help: the account lacks permission, or the request was blocked for another reason, such as an IP rule, a firewall or a disabled directory listing. Only a change in access rights fixes it.
How 403 Forbidden works
RFC 9110 lets a server refuse a request for any reason and, if it wishes, explain why in the body. If credentials were sent, they were found insufficient, and the client should not automatically retry with the same ones. The RFC also allows a server to answer 404 instead of 403 to hide that a forbidden resource exists, which GitHub does for private repositories. In practice 403 comes from many layers: the operating system's file permissions, the web server configuration, a web application firewall or CDN bot rule, and the application's own role checks.
Example 403 request and response
GET /admin/reports HTTP/1.1
Host: example.com
Cookie: session=valid-user-session
HTTP/1.1 403 Forbidden
Content-Type: text/htmlThe session is valid, so this is not an authentication problem: the logged-in user lacks the role the admin area requires.
What causes a 403 Forbidden
- File or folder permissions that the web server user cannot read.
- A directory requested with no index file while directory listing is disabled, for example by Apache Options -Indexes.
- An IP, country or bot rule in a firewall, WAF or CDN.
- A failed CSRF check; Django, for example, answers 403 with 'CSRF verification failed'.
- Object storage policies: Amazon S3 returns 403 Access Denied even for missing objects when the caller lacks permission to list the bucket.
How to fix a 403 Forbidden
If you are a visitor
- Check that the URL is right and that you are logged in with the account that should have access.
- If you use a VPN or proxy, try without it; IP and country blocks are common.
- Otherwise, ask the site owner for access. There is nothing else to fix on your side.
If you run the site
- Check file permissions and ownership; on Linux hosts, 644 for files and 755 for directories is the usual baseline.
- Make sure each directory has an index file, or that disabling listings is intentional.
- Review WAF and CDN security events for the blocked request.
- For S3 or other object storage, check bucket policies and that the object actually exists.
403 and SEO
Google treats 403 like other 4xx codes: if the URL was indexed, it is removed from the index. A firewall or CDN rule that starts sending 403 to Googlebot by mistake can therefore drop pages from search, so check bot rules after security changes. Google also warns against using 403 to slow crawling, and a robots.txt file that returns 403 is treated as if no robots.txt existed.
Related status codes
- 401 Unauthorized: Credentials are missing or invalid, so authenticating may fix it.
- 404 Not Found: What a server may send instead of 403 to hide that a resource exists.
- 429 Too Many Requests: The right way to push back on too many requests, rather than a 403.
Tools that help
- Chmod Calculator converts permissions such as 644 and 755 between numeric and symbolic form.
Frequently asked questions
The server understood the request but refuses to fulfil it, for example because the account lacks permission or a rule blocks the request.
Insufficient permissions for the requested resource, IP blocking, or a misconfigured access-control rule.
Confirm your account has the right permissions, or check server-side access rules (like .htaccess or firewall settings) if you control the server.
Check file and folder permissions first, then look for a missing index file, a deny rule in .htaccess or the server configuration, and blocks in your firewall or CDN logs. The web server error log usually names the exact rule that refused the request.
Sources
- RFC 9110, Section 15.5.4
- Google: How HTTP status codes affect Google's crawlers
- Google: How Google interprets the robots.txt specification
Other 4xx Client Error codes
Reviewed by Raja Jahangir · Last reviewed: October 7, 2026