4xx Client error
HTTP 403 Forbidden
The server understood the request but refuses to authorize it.
A 403 Forbidden means the server understood the request and knows who you are, but refuses to let you access the resource. Unlike 401, authenticating again won't change the result.
Common causes of a 403 error
- The account or API key lacks the required role or permission.
- The IP address, country, or user agent is blocked by a firewall, WAF, or rate limiter.
- A missing or invalid CSRF token on a form or API request.
- On a web server: wrong file or directory permissions, or a directory with no index file and listing disabled.
- A hotlink or CORS-style protection rejecting the request's Origin or Referer.
How to fix a 403 error
- Check the account's role and permissions, or ask the resource owner for access.
- Look at the firewall or WAF logs for a rule that's blocking your IP or request pattern.
- Include a valid CSRF token, and make sure cookies are being sent.
- On a server, check permissions (typically 644 for files and 755 for folders) and that an index file exists.
- Test from a different network to rule out an IP block.
Frequently asked questions
Is a 403 error my fault or the website's?
Either. It can mean you truly lack permission, or that a site's security rules are over-blocking you, for example a VPN IP or automated traffic. If you own the site, check the firewall and file permissions.
How do I fix a 403 on my own web server?
Check the file and folder permissions, that the web server user can read them, that an index file exists in the directory, and that no deny rule in the server config or .htaccess matches the request.
Other common status codes
See 403 in the full searchable list, or use the HTTP Header Checker to see the status code any URL returns.