HTTP 403 Forbidden

What HTTP 403 Forbidden means

403 Forbidden means the server understood the request and knows who you are, but you're not allowed to access this resource. Unlike 401, authenticating again won't help — the account simply lacks permission.

Which category is it?

403 is a 4xx code — Client error. 4xx means the request has a problem the client must fix — bad syntax, missing authentication, or a resource that isn't there. It's the caller's responsibility.

Common causes

• The authenticated user lacks the required role or permission
• IP or region restrictions
• Accessing a resource owned by someone else

How to fix it

• Grant the account the needed permission or role
• Confirm you're requesting a resource you own
• Check any IP allowlist or firewall rules

Example 403 response

HTTP/1.1 403 Forbidden
Content-Type: application/json

{"error":"You do not have access to this resource"}

How to diagnose a 403

1. Confirm you are authenticated as the account you expect. A request sent as the wrong user is a common reason for 403.
2. Check the role, scope or ACL the endpoint requires, and compare it with what the account or token actually has.
3. For web servers, check file and directory permissions, index-file rules, and directives that deny access (for example IP allow/deny lists).
4. Check for a WAF, CDN or bot-protection layer. These return 403 for blocked IPs, regions or suspicious user agents.

403 compared with similar codes

• 401: 401 asks you to authenticate. 403 means authentication was understood but access is refused, so retrying with the same credentials fails again.
• 404: A server may deliberately return 404 instead of 403 so unauthorized users cannot tell that a resource exists.

403 Forbidden: common questions

How do I fix a 403 Forbidden error?

As a user: check you are signed in to the right account and that you have access. As a developer: grant the needed permission, correct file permissions, or review firewall, WAF and IP rules.

Can a 403 be caused by a missing index file?

Yes. If directory listing is disabled and no index file exists, many web servers answer 403 for a directory URL.

Other client error (4xx) codes