403 Forbidden: why access is denied and how to fix it

403 Forbidden means the server understood the request and refuses to fulfill it. Logging in again won’t help: unlike 401, the problem isn’t missing credentials but a rule that says “not for you,” such as file permissions, an IP block, a firewall decision or the server configuration.

Definition

RFC 9110, section 15.5.4 says the server “understood the request but refuses to fulfill it,” and a client shouldn’t simply retry with the same credentials. The server may explain why in the response body or, if it wants to hide that the resource exists at all, answer 404 instead.

Common causes

• File permissions or ownership. The web server user can’t read the file or enter the folder. Typical safe values are 644 for files and 755 for directories.
• No index file and directory listing disabled. Nginx logs “directory index of … is forbidden”; Apache returns 403 under Options -Indexes.
• Deny rules in .htaccess or the server config (Require all denied, deny all), IP allowlists or geo-blocking.
• WAF and bot protection: CDN rules, security plugins or hosting firewalls that block crawlers, including Googlebot or AI search bots.
• Hotlink protection on images and downloads.

SEO impact

Per Google’s HTTP status code documentation, a 403 is handled like other 4xx codes: the URL isn’t indexed, indexed copies are removed, and the response content is ignored. Search Console labels it “Blocked due to access forbidden (403).” Google also says not to use 403 to slow Googlebot down, since it won’t reduce crawling. If robots.txt itself returns 403, Google treats the file as missing and assumes there are no crawl restrictions.

The dangerous case is a firewall that blocks crawlers while humans browse normally: rankings disappear and nobody on the team sees an error. The same goes for AI search. If your CDN returns 403 to OAI-SearchBot or Claude-SearchBot, those services can’t fetch or cite your pages, whatever your robots.txt allows.

How to fix a 403

For site owners

1. Find out whether everyone gets the 403 or only some clients. If a checker gets 403 but your browser doesn’t, look at your firewall, CDN bot settings or security plugin.
2. Allow verified search engine crawlers. Google explains how to verify Googlebot by reverse DNS or its published IP ranges; rely on that, not on the user-agent string.
3. Ask your host to check permissions and server rules if a whole folder or the whole site is affected.

For developers

# reset typical permissions (adjust the path and owner first)
find /var/www/site -type d -exec chmod 755 {} \;
find /var/www/site -type f -exec chmod 644 {} \;

# Nginx: make sure directories have an index file
index index.html index.php;

Use 403 for real authorization failures, not for missing pages or rate limiting, which is what 429 is for.

How to check

The HTTP status checker requests URLs from our servers, outside your logged-in session. The AI crawler checker goes further: it requests your page with real AI user-agents to spot firewall 403s that robots.txt doesn’t explain.

HTTP/1.1 403 Forbidden
Server: nginx
Content-Type: text/html
Content-Length: 146

Frequently asked questions