What Is a 403 Forbidden Error?

In short

A 403 Forbidden error means the server received and understood the request but refuses to fulfil it, because a rule says the requester may not access that resource. Common causes are file or directory permissions the web server cannot read, a directory with no index file and directory listing disabled, .htaccess or server rules denying access, a firewall or security plugin blocking the visitor's IP or user agent, hotlink protection, or a CDN security setting. Unlike a 401 it does not invite authentication; unlike a 404 the resource exists.

What it means

Status codes in the 400 range say the problem is with the request. 401 says authentication is required and not provided; 404 says the thing does not exist; 403 says the thing exists, the request was understood, and access is denied. The server may say why, or it may say nothing, since explaining the rule can help an attacker.

So a 403 is the result of a rule: a permission on a file, a directive in a configuration, a firewall decision, a security plugin's judgement. Fixing it means finding the rule.

The common causes

File and directory permissions. The web server process cannot read the file or traverse the directory. Common after uploading files as the wrong user, restoring a backup, or a migration. On Linux, files typically need to be readable (644) and directories executable (755) by the server user, and owned appropriately.

No index file with directory listing off. A request for a directory, such as /images/, where there is no index.html or index.php and the server is configured not to list contents, which is the sensible default, returns 403. Add an index file or accept that the directory is not meant to be browsed.

Deny rules in configuration. .htaccess on Apache, or the server configuration on Nginx, can deny access by path, IP, or pattern. A rule intended to protect an admin area or block a bot can catch legitimate requests if written too broadly. A security plugin or a host may have added rules without telling anyone.

Firewall and security plugins. Web application firewalls, whether at the host, in a plugin, or at a CDN, return 403 to requests they judge malicious: certain IP ranges, user agents, request patterns, countries, or too many requests. False positives are common, and a visitor on a VPN, a corporate network or an unusual browser may be blocked.

Hotlink protection. Serving images or files only when the referrer is your own site returns 403 to requests from elsewhere, including some legitimate ones such as email clients and feed readers.

CDN and platform settings. Cloudflare's firewall rules, bot fight mode, country blocks and access rules produce 403s the origin never sees. Platform hosting can return 403 for a site that is paused, unpaid, or whose domain is not verified.

IP or geographic blocks put in place after an attack and never removed.

Application-level authorisation. The application itself decided the logged-in user may not view that resource. Correct behaviour, but confusing when the rule is wrong.

When Googlebot gets a 403

Search Console reports "Blocked due to access forbidden (403)" when Googlebot is refused. The causes are the same as above with a twist: security rules that block unknown bots, aggressive rate limits, or firewall rules keyed on user agent frequently catch Googlebot, and the site quietly drops out of the index while looking fine to humans. Verify with URL Inspection, and make sure any bot protection allows verified search crawlers. A site whose pages are not showing up in Google despite being live is worth checking for exactly this.

The diagnosis in order

Is it everyone or just you? Try from another network or a phone on mobile data. If it works elsewhere, a firewall has blocked your IP, network or browser; look at the security plugin's or CDN's block log and allow-list yourself.
Is it one path or the whole site? One directory or file points to permissions, an index file, or a rule for that path. The whole site points to a server-level rule, an ownership problem, a CDN setting, or a suspended hosting account.
Check the CDN first if there is one. Its firewall event log names the rule that fired.
Check .htaccess and server rules for Deny, Require, or rewrite rules returning 403; temporarily rename .htaccess to test.
Check permissions and ownership of the file and every directory above it.
Check for a missing index file if the request is for a directory.
Check the hosting account status and the host's own security tools.
Read the server error log, which usually names the rule or the permission that failed.

Preventing it

Keep security rules specific: block the pattern that attacked, not every request that resembles it. Allow-list verified search crawlers explicitly in any bot protection. Set permissions deliberately during deploys rather than by hand. Keep a record of every firewall and access rule and why it exists, with a date, so that a block added during an incident is removed afterwards. And monitor 4xx rates as well as 5xx, since a 403 storm from a misfired rule looks like nothing in uptime checks and like a cliff in traffic.

A 403 is one of the quieter ways a site becomes unreachable; if you have found the code but not the rule, book a call and we will trace it.

Common questions

How do I fix a 403 Forbidden error?

Establish whether it affects everyone or just you, and one path or the whole site. Then check, in order: the CDN or security plugin's block log, .htaccess and server deny rules, file and directory permissions and ownership, whether a directory request lacks an index file, and the hosting account's status. The server error log usually names the rule that refused the request.

Why do I get a 403 error on a website but others don't?

A firewall or security rule has blocked your IP address, your network, your country, or your browser's user agent, often as a false positive after an attack or because you are on a VPN or a shared corporate address. Try another network to confirm, and ask the site owner to check their firewall log and allow-list you.

What is the difference between 401 and 403?

A 401 Unauthorized means the request lacks valid credentials and the server is inviting you to authenticate; log in and it may succeed. A 403 Forbidden means the server understood the request, with or without credentials, and refuses it under its rules; authenticating will not change the answer unless the rule depends on who you are.

Why does Google Search Console show 'blocked due to access forbidden (403)'?

Because Googlebot received a 403 when trying to crawl the page, usually from a security plugin, firewall or CDN rule that blocks unfamiliar bots or rate-limits crawlers, or from permissions or deny rules on the path. Verify with URL Inspection, allow verified search crawlers in any bot protection, and fix the path-level rule.

Can file permissions cause a 403 error?

Yes, and it is a common cause after uploads, restores or migrations. If the web server's user cannot read the file or traverse the directories above it, the server returns 403. On Linux hosting, files are typically 644 and directories 755, owned by or readable by the server user; correcting ownership and permissions resolves it.

hostingSecurityTechnical