403 Forbidden — Causes & Fix
HTTP 403 (Forbidden) means the server understood the request but refuses to authorise it — you don't have permission for this resource, and re-authenticating won't help.
- Applies to
- Any website or web server (HTTP standard)
- Time to fix
- 5–30 minutes
What it means
Causes include insufficient permissions, IP/geo blocking, a WAF/firewall rule, wrong file permissions, or a missing index file. HTTP status 403 is defined in RFC 9110 (HTTP Semantics). This is a client-side (4xx) error — the request itself had a problem, so the fix is usually on the requester's side or in how the server validates the request.
Symptoms
- "403 Forbidden" even when logged in
- Access denied to a page, folder, or API
How to fix it
- 1
Check permissions/access
1. As a user: confirm your account has access; try from a different network (IP blocks are common).
- 2
Fix server permissions (developers)
1. Check file/directory permissions and ownership. 2. Review WAF/firewall and access rules; ensure an index file exists for directories.
Frequently asked questions
Why 403 when I'm logged in?
403 is about authorisation, not authentication. Your account may lack permission, or a firewall/IP rule is blocking you — logging in again won't change it.
Last updated July 20, 2026
Guidance only — always consult a qualified professional or the official service manual before carrying out repairs.