403 Forbidden is the server saying: "I understood exactly what you asked for, and I'm refusing." It's a 4xx client error, but it's about permission, not a typo, the resource exists, you're just not allowed in.
403 vs 401: the key distinction
These two get confused constantly:
- 401 Unauthorized → "Who are you? Authenticate and try again." Logging in may fix it. See 401 Unauthorized.
- 403 Forbidden → "I know who you are (or don't care), and you still can't have this." Logging in usually won't help.
Common causes
| Cause | What's happening |
|---|---|
| File permissions | Wrong mode/ownership on the file or directory |
| Access rules | .htaccess or server config denying access |
| No index file | Directory listing disabled and no index.html |
| IP block | Your IP/region is on a deny list |
| WAF / Cloudflare | A security rule flagged the request |
| Authorization logic | The app checks a role/scope you don't have |
How to fix it, as a visitor
- Re-check the URL, a wrong path to a protected directory returns 403.
- Clear cookies and cache; an expired session can trigger it.
- Turn off a VPN/proxy that might be on an IP block.
- Log in if the page is behind authentication.
How to fix it, as a developer
- Permissions: directories
755, files644; correct ownership for the web user. - Access rules: review
.htaccess/ Nginxlocationblocks fordenydirectives. - Index file: add one or enable listing if appropriate.
- IP & WAF: check allowlists and firewall/WAF logs for false positives.
- Authorization: confirm your role/scope checks aren't rejecting valid users, and that they are rejecting invalid ones (a 403 is also your access control working).
When a spike of 403s matters
One 403 is a permissions glitch. A surge of 403s can mean two very different things: a deploy that broke your access rules and is locking out real users, or an attacker probing for resources they shouldn't reach. Either way you want to know fast.
Track status codes per endpoint in whatever monitoring or logging you already use, so a sudden rise in 403/401 responses gets noticed. See the API security checklist. And to catch the broken authorization before it ships: Nurbak's AI pentester scans your repo for missing auth checks and other exploitable bugs, and can open a PR with the fix. Your first scan is free.