403 Forbidden

A 403 is the server saying no on purpose. It received your request, it understood it, it knows what you are asking for, and it has decided you do not get it. There is no ambiguity about whether the server is working - It is, and it is refusing.

What makes 403 confusing for visitors is that the refusal is frequently not about you as a person. It is about the address you are connecting from, the software you appear to be running, or a rule that was never meant to catch you.

Why you specifically got one

Bot protection

The most common cause on large consumer sites by a wide margin. Bot management systems score every request on dozens of signals - User agent, TLS fingerprint, header ordering, request rate, address reputation - And refuse anything that scores badly. They are tuned aggressively because scraping is a real cost.

False positives are routine. An unusual browser, an aggressive privacy extension, a text-mode browser, or simply an address that another customer of your ISP has abused will all do it. This is the category most 403s a normal person encounters fall into.

Your IP address

Closely related and worth separating. Addresses get blocked in ranges, and you inherit the reputation of whoever shares yours.

• VPN exit nodes are used by a very wide mix of traffic and are blocked by a lot of sites, particularly banks, retailers and streaming services.
• Datacentre ranges are blocked almost universally, because legitimate human traffic rarely originates there.
• Carrier-grade NAT means thousands of mobile customers share one address, and one bad actor affects all of them.
• Geographic blocks refuse whole countries, sometimes for licensing reasons and sometimes for abuse reasons.

Disconnecting a VPN and retrying is the single most productive test for a visitor facing a 403.

Authentication and authorisation

The textbook meaning. You are signed in, the server knows who you are, and your account does not have access. Note the distinction from 401 Unauthorized, which actually means "not authenticated" - A confusing piece of naming that has survived since the beginning. 401 means log in; 403 means logging in will not help.

Directory listing disabled

Requesting a directory with no index file on a server configured not to list contents. Harmless and usually accidental.

If a whole site returns 403

Different problem, and it is an outage. When every page of a site returns 403 the usual causes are file permissions - The web server process cannot read the files it is meant to serve - Or a misconfigured access rule applied at the wrong level.

On Apache, a stray Require all denied or a botched .htaccess does this to everything beneath it. After a deploy that changes file ownership, a site-wide 403 is one of the most common failure modes on traditional hosting.

403 versus 429

Both are refusals and the line between them is blurred in practice. A 429 should mean "you are going too fast, slow down and try again". A 403 means "no". Many services return 403 for rate limiting anyway, which is unhelpful because it removes the signal that waiting might work.

If you get a 403 immediately after making a number of requests quickly, treat it as a rate limit regardless of the number: Wait several minutes before retrying.

What to do as a visitor

1. Turn off your VPN. The highest-yield single test.
2. Try a private window. Rules out extensions and a corrupted session cookie.
3. Try mobile data. A completely different address. If it works there, your home or office address is the problem.
4. Check whether you are signed in. Some sites return 403 rather than redirecting an expired session to a login page.
5. Slow down. If you were clicking rapidly or refreshing, wait five minutes.
6. Try a mainstream browser. Unusual user agents are scored badly by bot protection.

If none of that works and other people can reach the page, your address is almost certainly on a list. Most sites have no self-service way to get off one, and contacting support is the only route.

If it is your site

Check whether the 403 comes from your application, your web server, or a CDN in front of both - They look identical to a visitor and have completely different causes. A Cloudflare-served 403 carries a ray ID and means Cloudflare refused the request before your server saw it, usually a firewall rule or bot score.

For file permissions, confirm the web server user can read the document root and traverse every directory above it. For access rules, check inheritance: A rule applied at the server level overrides what you think you configured per-directory.

And be careful about over-blocking. Aggressive bot rules refuse real users, and those users get no explanation and no route to appeal. If you must block, an explanatory page with a contact route costs very little and prevents the class of complaint that starts with "your site is broken".