403 Forbidden Error: What It Means and How to Fix It

A 403 Forbidden error is the web's way of saying "I know what you want, and you can't have it." The server is up, the page may well exist, but access is refused. For a visitor that's a dead end. For a site owner it can be much worse, because the same rule that blocks a visitor can quietly block Googlebot, and pages that Google can't access drop out of search.

This guide explains what a 403 Forbidden error means, how it differs from 401 and 404, what causes it, and how to fix it as a visitor and as a site owner, with specific steps for Apache, nginx, WordPress and Cloudflare. It also covers the SEO side, which most guides skip.

What does 403 Forbidden mean?#

403 Forbidden is an HTTP status code. The HTTP standard (RFC 9110) defines it as a response from a server that understood the request but refuses to fulfill it.

The key word is refuses. A 403 isn't a crash or a missing page. The server deliberately said no, based on a rule: file permissions, a configuration setting, a firewall, a security plugin or an access list. And unlike a login prompt, logging in usually won't change the answer.

What a 403 error looks like#

The message varies with the server and the site:

• 403 Forbidden
• Forbidden: You don't have permission to access this resource (Apache)
• 403 Forbidden nginx (nginx's default page)
• Access Denied or Error 403: Access Forbidden
• Sorry, you have been blocked (Cloudflare's firewall page)
• HTTP Error 403 in browsers that show the raw code

They all mean the same thing: the request reached a server, and the server refused it.

403 vs 401 vs 404#

These three are easy to confuse:

A 401 says "who are you?". A 403 says "I know, and the answer is no." A 404 says "there's nothing here." Some servers return a 404 instead of a 403 on purpose, to avoid confirming that a private resource exists. For missing pages, see our guide to the 404 error.

Common causes of a 403 Forbidden error#

On the website's side, the usual causes are:

1. Wrong file or folder permissions. The web server can't read the files it needs to serve.
2. No index file, with directory listing turned off. Requesting a folder like /images/ with no index.html or index.php returns 403 instead of a file list. This is normal and safe behavior.
3. Rules in .htaccess or the server config. A Deny from all, Require all denied or nginx deny line blocks the path or visitor.
4. A security plugin or firewall. Wordfence, Sucuri, ModSecurity, Cloudflare's WAF and similar tools block requests they consider suspicious, sometimes including legitimate visitors and bots.
5. IP or country blocking. Rules that block regions or IP ranges, sometimes far too broad.
6. Hotlink protection. Images or files blocked when requested from another domain.
7. Wrong ownership after a migration. Files copied by the wrong user can't be read by the web server, even with correct permission numbers.
8. Bot protection. Rate limiting or bot challenges that reject automated requests, including tools and search engine crawlers.

On the visitor's side, a stale cookie, a VPN or an IP address with a bad reputation can trigger the block.

How to fix a 403 Forbidden error as a visitor#

If you see a 403 on someone else's site:

1. Check the URL. A typo, or a link to a folder instead of a page, can return 403.
2. Reload the page. Temporary firewall blocks sometimes clear quickly.
3. Clear cookies for the site and try again, or open a private window.
4. Log out and back in if the site has accounts. An expired session can cause a 403.
5. Turn off your VPN or proxy. Many firewalls block VPN and data center IP addresses.
6. Try another network, such as mobile data instead of Wi-Fi.
7. Contact the site owner if nothing works. Only they can change the rule blocking you.

How to fix a 403 Forbidden error on your website#

If your own site returns 403, work from the most common cause down.

1. Find out who is blocked#

First, establish the scope:

• Is it one page, one folder, or the whole site?
• Is it every visitor, or only some IP addresses, countries or devices?
• Did it start after a deploy, migration, plugin install or firewall change?

Check your URLs from outside with the free Bulk URL Status Checker, which shows the status code each URL returns. Then look at the response itself: a Cloudflare "Sorry, you have been blocked" page means the block is at Cloudflare, not on your server.

2. Read the server error log#

The error log usually names the exact reason:

• Apache: /var/log/apache2/error.log or /var/log/httpd/error_log. Look for lines like client denied by server configuration or Permission denied.
• nginx: /var/log/nginx/error.log. Look for directory index of ... is forbidden (no index file) or (13: Permission denied).
• Managed hosting: the logs are usually under a "Logs" or "Error log" section of the control panel.

3. Fix file permissions and ownership#

On most Linux servers, the standard permissions are:

• Folders: 755
• Files: 644
• WordPress wp-config.php: 640 or 600 is common, as long as the web server can still read it

You can reset permissions from the site root with:

find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;

If the numbers are right but the error stays, check ownership. The files must be owned by, or readable by, the user the web server runs as, such as www-data on Debian and Ubuntu.

4. Add an index file or check directory rules#

If the log says "directory index is forbidden", the folder has no index file. Add one, or link to a real page instead of the folder. Don't turn on directory listing just to remove the error, because it exposes every file in that folder.

5. Check .htaccess and server rules#

On Apache, a broken or overly strict .htaccess is a very common cause. Rename it to .htaccess-old and reload the page. If the 403 disappears, the problem is in that file. On WordPress, you can regenerate a clean one by going to Settings > Permalinks and clicking Save Changes.

On nginx, search the config for deny rules and location blocks that match the blocked path.

6. Check your firewall and security plugin#

If the block only affects some visitors, a firewall is the likely cause:

• WordPress security plugins: check the plugin's block log for the visitor's IP. Temporarily deactivating the plugin confirms it quickly.
• Cloudflare: open Security > Events to see which rule blocked the request, then adjust or skip that rule.
• Host-level firewalls and ModSecurity: ask your host which rule triggered.

7. Fixes specific to WordPress#

• Deactivate plugins one at a time, starting with security and caching plugins.
• Regenerate .htaccess through Settings > Permalinks.
• Check that wp-admin isn't blocked by an IP rule that no longer includes your address.
• After a migration, reset permissions and ownership as described above.

Does a 403 Forbidden error hurt SEO?#

Yes, if search engines get it. Google's crawling documentation is clear about 4xx responses: Google doesn't index URLs that return a 4xx status code, and URLs that are already indexed and return a 4xx status are removed from the index. A 403 counts. It doesn't matter that the page loads fine for you.

The dangerous case is a 403 served only to Googlebot, usually by a firewall or bot protection rule that treats the crawler as a threat. Everything looks normal in your browser while pages quietly drop out of search. Signs include:

• "Blocked due to access forbidden (403)" in Google Search Console's Page indexing report.
• Pages disappearing from search after a security plugin or firewall change.
• Crawl stats in Search Console showing a jump in 4xx responses.

A few rules to protect your rankings:

• Don't block Googlebot by user agent rules alone. If you need to verify it, check that the IP belongs to Google with a reverse DNS lookup, or against the IP ranges Google publishes.
• Don't use 403 for rate limiting. Google advises using 429 or 503 instead, which tell crawlers to slow down rather than treat the page as forbidden.
• Don't block CSS and JavaScript files Google needs to render your pages.
• Check robots.txt separately. If robots.txt itself returns a 403, Google treats it as if no robots.txt exists. Our robots.txt guide covers the details.

How to catch 403 errors before they cost you traffic#

A 403 is easy to miss, because the people most likely to notice it, the site owner and the team, are often the ones the firewall trusts. Meanwhile customers in another country, or Googlebot, are being turned away.

MyKavo checks your pages from outside your network:

• Page scans against an approved baseline. If a monitored page that used to return 200 starts returning a 403, MyKavo raises it as a critical change, showing the old and new status side by side.
• Grouped link alerts. Internal links that start returning errors are grouped into a single broken links alert, not dozens of emails.
• Uptime checks every 5 minutes on your homepage, with an alert after two failed checks in a row.

The bottom line#

A 403 Forbidden error means the server deliberately refused the request. Visitors can try clearing cookies, logging in again and turning off a VPN. Site owners should establish who is blocked, read the error log, then fix permissions, index files, .htaccess rules or firewall settings.

Above all, make sure Googlebot isn't the one being turned away. Check your important URLs now with the free Bulk URL Status Checker, then start free with MyKavo to get alerted the moment a page starts returning 403.