HTTP 403 Forbidden

Status code 403 · Class 4xx

HTTP

Forbidden

Also searched as: error 403, HTTP 403, 403 forbidden, access forbidden

HTTP request chain from browser through CDN and proxy to the origin server
HTTP errors: find which hop in the request chain failed and read its logs.

What it means

403 Forbidden means the server understood who you are (or does not care) and refuses to give you this resource. Visitors see it on pages restricted by permissions, geo-blocking or a firewall; site owners see it from wrong file permissions, missing index files or security rules.

Applies to: All browsers, nginx, Apache, IIS, Cloudflare

How to fix HTTP 403 Forbidden

  1. Reload, then clear cookies for the site and log in again
  2. Check that the URL is correct; pointing at a directory without an index file often returns 403
  3. Disable VPN or proxy; many sites and firewalls block known VPN ranges
  4. If you think you should have access, contact the site owner with the time and URL
  5. If you own the site: check file permissions (commonly 644 for files and 755 for directories) and ownership by the web server user
  6. If you own the site: look for deny rules in .htaccess, nginx 'deny' or 'location' blocks, and WAF/security plugin logs (Cloudflare, ModSecurity, Wordfence)
  7. If you own the site: make sure an index file exists or directory listing is intentionally disabled

Why it happens

Per RFC 9110, 403 means the server refuses to authorize the request. Filesystem permissions, access rules, IP or country blocks, WAF rules and missing index files with listing disabled are the usual sources.

FAQ

Can a VPN cause 403 Forbidden?

Yes. Many sites and CDNs block or challenge traffic from VPN and data-center IP ranges.

How do I fix 403 Forbidden on WordPress?

Check file permissions, regenerate .htaccess by saving Permalinks, and temporarily disable security plugins to see which rule blocks you.

Related errors

EPERM (errno 1)EACCES (errno 13)HTTP 404 Not FoundHTTP 401 UnauthorizedHTTP 405 Method Not AllowedHTTP 302 FoundHTTP 304 Not ModifiedHTTP 400 Bad Request

Source: IANA HTTP Status Code Registry · fixes written and reviewed by the editors (see our editorial policy)

Last updated: