---
title: "403 Forbidden"
canonical: "https://lemwatch.com/http-status-codes/403"
category: "client-error"
last_verified: "2026-08-11"
source: "https://lemwatch.com"
---

# HTTP 403 Forbidden

**TL;DR** — A 403 means "the server understood your request and is refusing it" — not because you need to log in (that's 401) but because permission won't be granted regardless. Common causes: wrong file permissions, firewall blocking your IP, .htaccess deny rules, hotlink protection, or geo-restriction. Open the server error log to see the actual rule that triggered.

## What it means

HTTP 403 Forbidden means the server understood what you asked for and is deliberately refusing to serve it. This is fundamentally about authorisation, not authentication: it isn't saying "log in" (that's 401), it's saying "even if you did log in, you wouldn't get this." 403 covers a wide range of refusal scenarios — your IP is blocked, the file has the wrong permissions, the directory has indexing disabled, a hotlink protection rule fired, or a geo-restriction policy applied to your region. Unlike 451 (which specifically signals legal blocking), 403 doesn't tell you why — that's a deliberate design choice to avoid leaking information about server configuration.

## Common causes

- File or directory permissions are wrong (chmod 000, owned by root, web user can't read)
- Apache .htaccess "deny from all" or "Require all denied" rule
- Nginx "deny" directive in the server block
- IP-based firewall block (iptables, ufw, Cloudflare WAF, AWS security group)
- Geographic restriction enforced at CDN or origin level
- Hotlink protection blocking image requests with the wrong Referer header
- Directory listing disabled when no index.html exists (Apache default)
- WordPress wp-admin/wp-login.php access locked to specific IPs
- API key valid but lacks the scope/permission for this endpoint

## How to fix

- Open the server access and error logs — they will show the exact rule that fired
- Check file permissions: chmod 644 for files, chmod 755 for directories, and ensure the web user (www-data, nginx, apache) owns or can read them
- Review .htaccess, nginx.conf, and any WAF rules for "deny" or "Require denied" directives
- Check the Cloudflare / CloudFront / origin firewall for IP blocks — your home IP being blocked is a surprisingly common cause
- For hotlink protection 403s: confirm the request Referer header matches your allowlist, or remove the rule if you no longer need it
- If a previously-public page suddenly returns 403, check for recent config changes, plugin updates, or security-rule deployments
- For API 403s: verify the auth token has the required scopes — most APIs return 403 when authentication succeeds but authorisation fails

## SEO impact

Pages returning 403 are not indexed by Google. If a previously-indexed page starts returning 403, Google removes it from search results within days to weeks. A sitewide 403 (often from a hosting suspension or firewall misconfig) deindexes the entire site fast. Google does not distinguish between "intentionally locked" and "accidentally locked" — both look like a content disappearance, which damages rankings. If you need to block access to staging or admin pages, use authentication (401) or robots.txt instead of 403 to avoid this signal.

## Monitoring tip

LemWatch alerts the moment a previously-public page starts returning 403 — almost always the sign of a firewall rule change, plugin update, or accidental .htaccess edit. We also distinguish between consistent 403s (deliberate) and sudden new 403s (likely a mistake).

**Related:** [401](https://lemwatch.com/http-status-codes/401.md), [404](https://lemwatch.com/http-status-codes/404.md), [451](https://lemwatch.com/http-status-codes/451.md), [407](https://lemwatch.com/http-status-codes/407.md)

_Canonical HTML page: https://lemwatch.com/http-status-codes/403_