HTTP 403 Forbidden — Meaning, Causes & How to Fix
The server understood the request but refuses to authorize it, regardless of credentials.
- Code
- 403
- Name
- Forbidden
- Class
- 4xx Client Error
- Specification
- RFC 9110 §15.5.4
- Cacheable by default
- Only with explicit Cache-Control / Expires
What HTTP 403 means
403 Forbidden means the server understood the request and refuses it. Unlike 401, re-authenticating will not help (or the server does not want to say). A server may also choose 404 instead of 403 to hide that a resource exists.
Common causes
- Wrong file or folder permissions on the server.
- Directory listing disabled and no index file present.
- A WAF, CDN or .htaccess rule blocking an IP, country or user agent.
- The logged-in user lacks the required role.
How to fix it
For site owners
- Check file permissions (commonly 644 for files, 755 for folders) and ownership.
- Make sure the folder has an index file.
- Review firewall/CDN rules — make sure they do not block search engine crawlers.
For visitors & developers
- Check you are logged in with the right account.
- A VPN or proxy IP may be blocked; try without it.
SEO impact
Google treats 403 like other 4xx errors: the page is not indexed and drops out over time. Accidentally returning 403 to Googlebot (a bot-blocking rule) can deindex a whole site — check with the URL Inspection tool.
Example 403 response
HTTP/1.1 403 Forbidden
Content-Type: text/html; charset=utf-8
Content-Length: 162Related status codes
Check or look up another code
Search and filter every code in the HTTP Status Codes tool, browse the full list by class, or read HTTP status codes explained: the complete developer guide.
Open HTTP Status Codes tool →All status codesFrequently asked questions
What does HTTP 403 mean?
HTTP 403 Forbidden is a 4xx Client Error status code. The server understood the request but refuses to authorize it, regardless of credentials.
Can I use 403 to slow down Googlebot?
No. Google’s documentation says to use 503 or 429 to reduce crawl rate; 4xx codes (except 429) cause URLs to be dropped from the index instead.
Which specification defines 403?
It is defined in RFC 9110 §15.5.4.
Is a 403 response cacheable?
Not by default. A 403 response is only stored by caches when it carries explicit freshness information such as Cache-Control: max-age or Expires.