HTTP
HTTP 403Forbidden
HTTP 403 Forbidden means the server understood the request and knows what you want but will not allow it, and authenticating differently will not change that. On a web server it usually comes from file permissions, a missing index file with directory listing disabled, an IP or geographic block, or a security rule.
What 403 means
"I know who you are (or I do not care), and the answer is no." Where 401 invites the client to authenticate, 403 says the request will not be fulfilled regardless. A server may also return 404 instead of 403 when it does not want to reveal that a resource exists.
Server-side causes
| Cause | Where to look |
|---|---|
| File not readable by the web server user | ls -l; fix with chmod 644 file, chmod 755 dir (chmod calculator) |
Directory requested, no index file, Options -Indexes | Add index.html or enable listing deliberately |
Require / deny rules in Apache config or .htaccess | .htaccess in the path, <Directory> blocks |
nginx deny, allow or missing index | server block |
| Web application firewall or bot protection | WAF logs; Cloudflare firewall events |
| Geographic or IP-range block | CDN or firewall rules |
| Hotlink protection for images | Referer-based rules |
| SELinux context on the file | ls -Z, restorecon |
| IIS: missing handler mapping or authorization rule | IIS Manager, web.config <authorization> |
| Application-level permission check | Application logs |
For visitors
- Confirm the URL points at a page, not a bare directory.
- Log out and back in; expired sessions on some sites produce 403 rather than 401.
- Disable VPN or proxy; try mobile data.
- Clear cookies for the site.
- If a "Reference #" or "Ray ID" appears, the block is from a CDN; only the site owner can lift it.
For administrators
Read the error log; Apache records client denied by server configuration or AH01276: Cannot serve directory with the path. Test from the server itself to separate network blocks from file issues:
curl -I -A "Mozilla/5.0" https://example.com/path/If a plain User-Agent gets 403 and a browser-like one gets 200, a bot rule is responsible; the User-Agent parser helps compare strings. On Windows servers, the file permissions record explains NTFS ACLs for the application pool identity.
Frequently asked questions
How do I fix a 403 as a visitor?
Check the URL (a directory URL without an index page returns 403 on many servers). Log out and in again if the site has accounts. Try without a VPN, since geographic and data-centre blocks are common. Clear cookies. If it still fails, the block is on the server side.
403 on my own website after uploading files — why?
File permissions. Files need to be readable by the web server user (typically 644) and directories traversable (755). The chmod calculator shows what those numbers mean. Also confirm an index.html or index.php exists in the directory.
Why does curl get 403 but the browser works?
A bot-protection layer (Cloudflare, WAF) is rejecting requests without a browser-like User-Agent or without JavaScript challenge cookies. Sending a normal User-Agent header sometimes suffices; otherwise the block is intentional.