Skip to content
Webmaster Tools
Inspect & debugHTTP Status Codes403 Forbidden

403 Forbidden

What HTTP 403 Forbidden means, its common causes in nginx, Apache, Cloudflare and S3, how it differs from 401 and 404, and what it does to Google crawling.

All status codes

What 403 means

The server understood the request but refuses to fulfil it. 403 is defined in RFC 9110 §15.5.4. Unlike 401 Unauthorized, sending credentials (again) won't help: either the server knows who you are and you're not allowed, or access is refused for a reason unrelated to identity. A server that wants to hide that a resource exists may send 404 Not Found instead.

HTTP/1.1 403 Forbidden
Content-Type: text/html

<h1>Forbidden</h1><p>You don't have permission to access this resource.</p>

Common causes

  • File system permissions. The web server user can't read the file, or can't traverse a parent directory (directories need the execute bit). nginx logs "permission denied" with a 403.
  • No index file and listing disabled. Requesting a directory without index.html gives 403 in nginx ("directory index of ... is forbidden") and in Apache with Options -Indexes.
  • Access rules: Apache Require all denied or Require ip, nginx deny, .htaccess rules, IP allowlists, country blocks.
  • Firewalls and bot protection. Cloudflare WAF and custom rules (error 1020 "Access denied"), ModSecurity, AWS WAF or a hosting provider's bot filter blocking an IP, user agent or request pattern.
  • Cloud storage. Amazon S3 returns 403 AccessDenied for a missing object when the requester isn't allowed to list the bucket, so a 403 there can mean "not found". Also check bucket policies, Block Public Access and signed URL expiry.
  • App-level checks: a missing role or scope, a failed CSRF token check (Django's "CSRF verification failed" is a 403), hotlink protection checking Referer.

How to fix it

  1. Check the server's error log; it usually names the rule or file behind the 403.
  2. Fix permissions: files readable (644), directories traversable (755), owned by the right user; on SELinux systems, check the file context too.
  3. Add an index file, or enable listing deliberately (autoindex on; in nginx).
  4. In Cloudflare, look up the request in Security Events to see which rule blocked it, then adjust or add a skip rule.
  5. As a client: confirm you're logged in as the right user with the right scopes; if a WAF blocks you, contact the site rather than retrying.

403 and SEO

A 4xx tells Google the content isn't available: 403 pages aren't indexed, and indexed URLs that start answering 403 drop out. The common accident is a firewall or bot rule that blocks Googlebot while browsers get through; Search Console's URL Inspection shows what Googlebot actually gets. Allow verified search engine crawlers (checked by reverse DNS or their published IP ranges) rather than trusting or blocking by user agent alone. Google also advises against using 403 (or 401) to reduce crawling; return 429, 500 or 503 for a short while, or let Googlebot adjust on its own.

Compare what a URL returns to a plain client with what your browser sees using the Redirect Checker, or vary the headers in the HTTP Request Builder.