403 Forbidden is the server saying: "I understood exactly what you asked for, and I'm refusing." It's a 4xx client error, but it's about permission, not a typo — the resource exists, you're just not allowed in.
403 vs 401: the key distinction
These two get confused constantly:
- 401 Unauthorized → "Who are you? Authenticate and try again." Logging in may fix it. See 401 Unauthorized.
- 403 Forbidden → "I know who you are (or don't care), and you still can't have this." Logging in usually won't help.
Common causes
| Cause | What's happening |
|---|---|
| File permissions | Wrong mode/ownership on the file or directory |
| Access rules | .htaccess or server config denying access |
| No index file | Directory listing disabled and no index.html |
| IP block | Your IP/region is on a deny list |
| WAF / Cloudflare | A security rule flagged the request |
| Authorization logic | The app checks a role/scope you don't have |
How to fix it — as a visitor
- Re-check the URL — a wrong path to a protected directory returns 403.
- Clear cookies and cache; an expired session can trigger it.
- Turn off a VPN/proxy that might be on an IP block.
- Log in if the page is behind authentication.
How to fix it — as a developer
- Permissions: directories
755, files644; correct ownership for the web user. - Access rules: review
.htaccess/ Nginxlocationblocks fordenydirectives. - Index file: add one or enable listing if appropriate.
- IP & WAF: check allowlists and firewall/WAF logs for false positives.
- Authorization: confirm your role/scope checks aren't rejecting valid users — and that they are rejecting invalid ones (a 403 is also your access control working).
When a spike of 403s matters
One 403 is a permissions glitch. A surge of 403s can mean two very different things: a deploy that broke your access rules and is locking out real users, or an attacker probing for resources they shouldn't reach. Either way you want to know fast.
Nurbak Watch tracks status codes per endpoint, so a sudden rise in 403/401 responses alerts you immediately — and Nurbak's scanner checks your app for the broken authorization that causes them. See the API security checklist.