403 Forbidden — What It Means and How to Fix It

What 403 means

The server knows who you are and is declining anyway. Unlike a 401, authenticating again will not help — the answer will be the same. A 403 is a decision, not a missing credential.

Common causes

•The authenticated user lacks the required role or permission.
•A WAF or bot-protection rule matched the request.
•IP allowlisting excluding the caller.
•Filesystem permissions preventing the web server reading the file.
•Directory listing disabled with no index file present.
•Geographic or rate-based blocking at the CDN.

How to fix it

Separate the two big cases first: is this an application permission decision or an edge/WAF block? Check whether the response came from your application or from your CDN — the response headers usually reveal which. A 403 with a Cloudflare or security-vendor header is an edge rule, and looking at your application's permission logic will waste your time.

Catching 403 before your users report it

A monitor that suddenly starts getting 403 across every region has usually been caught by a new WAF rule or bot-protection setting rather than a permissions change. Allowlist your monitoring source before assuming an application fault.

Monitor for 403 responses free

Often confused with

401 Unauthorized 404 Not Found

← All HTTP status codes

403 Forbidden — questions

Will retrying a 403 help?

No. A 403 is a deliberate refusal, and repeating the identical request produces the identical answer. Retrying can make things worse if a rate-based rule triggered the block in the first place.

Why does my site return 403 to some visitors only?

Almost always an edge rule — geographic blocking, IP reputation, or bot detection. These apply to a subset of traffic by design, which is exactly why the problem looks intermittent from where you are sitting.

403