403 Forbidden: what it means and how to fix it

A 403 Forbidden means the server understood the request but won't let you see the page. The common causes, and fixes for visitors and site owners.

1. The short answer

A 403 Forbidden error means the server understood your request but refuses to let you have the page. Unlike a 404, the server isn't saying the page is missing; it's saying "not for you". On your own site, the usual causes are file permissions, a folder with no index file, or a rule in the server or a firewall that blocks the request.

403 is an HTTP status code. RFC 9110 lets a server that wants to hide that a page exists answer 404 instead, so some private pages show up as 404.

2. What you'll see

It can be a plain "403 Forbidden" page from nginx or Apache, "You don't have permission to access this resource", "Access denied", or a Cloudflare page saying "Sorry, you have been blocked". Cloudflare's block pages often carry their own error number, such as 1020 (Access denied), while the HTTP status underneath is still 403.

3. Common causes

• No index file, and directory listing turned off. You visit / or /images/, there's no index.html or index.php, and the server won't show the folder's contents.
• File or folder permissions. The web server can't read the file or enter the folder. Files usually need 644 and folders 755.
• Wrong file owner. On shared hosting, files uploaded as another user can be unreadable to the site.
• A deny rule. Require all denied or an IP block in .htaccess, or deny all in an nginx location.
• A firewall or security tool. Cloudflare's WAF, ModSecurity, or a WordPress security plugin decided the request looked like an attack.
• Your IP address or country is blocked. Common with VPNs, office networks and data-center addresses.
• Hotlink protection. Another site embeds your images, and the server refuses requests that don't come from your own pages.
• Private storage. A file in Amazon S3 or another bucket that isn't public answers 403 (AccessDenied).
• Signed in, but not allowed. The user lacks the role for that page, so the app answers 403.

4. How to fix a 403 as a visitor

1. Check the address. A link to a folder (ending in /) instead of a page can give 403.
2. Refresh, then try a private window. If that works, clear the site's cookies.
3. Switch off your VPN or proxy, or try mobile data, in case your IP address is blocked.
4. If the page is behind a login, sign in with an account that should have access.
5. If it lasts, tell the site owner, with the time, the address and any reference number on the page (Cloudflare shows a Ray ID).

5. How to fix a 403 on your own site

Start with the server's error log: it nearly always names the reason. Then work through the setup you have.

nginx. directory index of "/var/www/site/" is forbidden means there's no index file in that folder. (13: Permission denied) means nginx can't read a file or enter a folder; every folder on the path needs execute permission for nginx's user. Check location blocks for deny all.

# nginx: serve index.html, fall back for app routes
root /var/www/site;
index index.html;
location / {
    try_files $uri $uri/ /index.html;
}

# Fix permissions (files 644, folders 755)
sudo find /var/www/site -type f -exec chmod 644 {} +
sudo find /var/www/site -type d -exec chmod 755 {} +

Apache and cPanel hosting. AH01630: client denied by server configuration points to a Require or Deny rule, often in an .htaccess file in that folder or one above it. Options -Indexes with no index file also gives 403, so make sure DirectoryIndex includes the file you use. On shared hosting, check permissions and ownership in the file manager, and rename .htaccess for a moment to see whether the 403 goes away.

WordPress. Security plugins, a broken .htaccess after a migration, and ModSecurity rules are the usual culprits. Regenerate .htaccess by saving Settings, Permalinks, and deactivate security plugins one by one (rename their folder in wp-content/plugins if you can't sign in).

Node, Express and Next.js. These rarely return 403 by accident; your code or middleware sends it. Look for auth checks, role checks and CSRF protection (a missing or stale token gives 403 in many libraries). The operating system's file permissions still apply to static folders.

Cloudflare. Under Security, Events, filter by the Ray ID from the block page to see which rule fired. Adjust or skip that rule rather than turning security off.

6. On Cloudzyro

Web Hosting is cPanel: fix permissions and .htaccess in cPanel's File Manager, and check that your site's files sit at the top of the domain's folder, not one folder down.

On Sites & Apps, every site is behind Cloudflare. A static site needs an index.html at the top of what you upload, or the deploy stops with Missing files before anything goes live, so a missing home page never reaches visitors. See Fix a failed deploy.

7. A worked example

A designer uploads a new portfolio to shared hosting and gets 403 on the home page.

1. curl -I https://www.example.com returns HTTP/2 403.
2. The error log says Cannot serve directory /home/user/public_html/: No matching DirectoryIndex.
3. In the file manager, the files are in public_html/portfolio/, not public_html/. There's no index file at the top.
4. She moves the files up one level, and the home page answers 200.

8. How to check the status code

# Headers only: the first line is the status
curl -I https://www.example.com/page

# Pretend to be a normal browser, in case a firewall blocks curl
curl -I -A "Mozilla/5.0" https://www.example.com/page

If the second command works and the first doesn't, a firewall is blocking by user agent. The server: header says which layer answered (cloudflare, nginx, Apache). In a browser, open developer tools, choose the Network tab and reload: the Status column shows the code.

9. Related errors

• [401 Unauthorized](/guides/401-unauthorized): you need to sign in or send credentials.
• [404 Not Found](/guides/what-is-a-404-error): the page isn't there (or the server is hiding it).
• [405 Method Not Allowed](/guides/405-method-not-allowed): the page exists, but not for that kind of request.
• [429 Too Many Requests](/guides/429-too-many-requests): you're being rate limited, not blocked for good.

10. Sources

• RFC 9110, section 15.5.4: 403 Forbidden
• MDN: 403 Forbidden
• nginx: ngx_http_index_module
• Apache: Access control
• Cloudflare: Cloudflare 1xxx errors