The repo is private and Pages is serving from a branch that requires GitHub Pro/Team.
The repo is private and Pages is serving from a branch that requires GitHub Pro/Team.
Upgrade the org plan or make the repo public if the content is safe to expose.
The GitHub Actions deploy log, the Pages settings tab, or the raw response headers (`x-github-request-id`).
GitHub Pages — free static hosting from a repo.
The server understood the request but refuses to fulfil it — different from 401 in that authentication won't help; you simply don't have permission.
HTTP 403 Forbidden means the server understood what you asked for and is deliberately refusing to serve it. This is fundamentally about authorisation, not authentication: it isn't saying "log in" (that's 401), it's saying "even if you did log in, you wouldn't get this." 403 covers a wide range of refusal scenarios — your IP is blocked, the file has the wrong permissions, the directory has indexing disabled, a hotlink protection rule fired, or a geo-restriction policy applied to your region. Unlike 451 (which specifically signals legal blocking), 403 doesn't tell you why — that's a deliberate design choice to avoid leaking information about server configuration.
Pages returning 403 are not indexed by Google. If a previously-indexed page starts returning 403, Google removes it from search results within days to weeks. A sitewide 403 (often from a hosting suspension or firewall misconfig) deindexes the entire site fast. Google does not distinguish between "intentionally locked" and "accidentally locked" — both look like a content disappearance, which damages rankings. If you need to block access to staging or admin pages, use authentication (401) or robots.txt instead of 403 to avoid this signal.
LemWatch alerts the moment a previously-public page starts returning 403 — almost always the sign of a firewall rule change, plugin update, or accidental .htaccess edit. We also distinguish between consistent 403s (deliberate) and sudden new 403s (likely a mistake).