403 Forbidden

The server understood the request but refuses to authorize it.

403 at a glance

Code: 403
Name: Forbidden
Class: 4xx Client error
Status: IANA-registered standard code
Defined in: RFC 9110, Section 15.5.4
Cacheable by default: No by default. Caches store it only when the response carries explicit freshness (Cache-Control max-age, s-maxage or Expires).

What 403 means

403 Forbidden means the server will not fulfil the request, and re-authenticating will not help (unlike 401). The reason may be permissions, IP restrictions, a WAF rule or a policy decision. A server that does not want to reveal that a resource exists may return 404 instead.

What typically causes a 403

File-system permissions: nginx or Apache cannot read the file or directory (check error.log for "Permission denied").
Directory without an index file when listing is off: nginx autoindex off, Apache Options -Indexes.
Apache Require all denied, .htaccess deny rules, or nginx deny.
Cloudflare WAF, Bot Fight Mode or firewall rules (error 1020 "Access denied").
AWS S3: AccessDenied from bucket policy, missing IAM permission, or a missing object when the caller lacks s3:ListBucket.
CSRF failures in Django ("403 Forbidden: CSRF verification failed") and some frameworks.
GitHub API returns 403 when the primary rate limit is exhausted (with x-ratelimit-remaining: 0).

Fix it on the server

Read the error log: it usually names the exact file and reason.
Make sure the web server user can traverse every parent directory (namei -l /path/to/file).
If you use a WAF, check its event log for the rule that fired before changing app code.

Fix it as a client or visitor

You may be blocked by IP, country, user agent or a VPN exit node; try another network to test.
For S3, check bucket policy, object ACLs and whether the key really exists.
If you are logged in, your account may lack the role; ask the admin rather than retrying.

Example response

HTTP/1.1 403 Forbidden
Server: nginx
Content-Type: text/html

<html><head><title>403 Forbidden</title></head>...