403 Forbidden: what it means, who sent it and how to fix it

02Which layer returned the 403?

The same code comes from at least five places, and the response usually gives the layer away: a default page names the server software, a WAF or CDN block page carries a reference or ray ID, and an application returns its own page or JSON. Provider codes are collected in the Cloudflare error codes guide.

Then compare the public hostname with the origin: 403 at the edge and 200 at the origin means the edge is blocking; 403 at both means the origin or the application is. Some firewalls refuse command-line tools, so confirm a curl result in a browser's developer tools.

# status, Server and any provider headers from the public hostname
curl -sI https://example.com/private/report.pdf

# the first lines of the body: default server page, block page or app page?
curl -s https://example.com/private/report.pdf | head -n 20

# compare: the same request sent directly to your own origin server
curl -sI --resolve example.com:443:203.0.113.10 https://example.com/private/report.pdf

03403 troubleshooting by symptom

Who gets the 403, and on which URLs, narrows the cause faster than any single setting. Each row names the layer that most often generates it.

04What does the nginx error log say about a 403?

nginx logs the reason in the same second as the 403, by default in /var/log/nginx/error.log on Debian and Ubuntu. The lines below were reproduced on nginx 1.22.1 with workers running as www-data; paths are shortened.

A deliberate return 403, as in hotlink rules, leaves no error-log line, so if the error log is silent, search the configuration for return 403 and deny. Permission errors are often on a directory above the file, which namei -l shows in one command.

# what does the worker user see along the path?
namei -l /var/www/site/private/page.html
sudo -u www-data test -r /var/www/site/private/page.html && echo readable

# reset permissions under the document root (never 777)
find /var/www/site -type d -exec chmod 755 {} +
find /var/www/site -type f -exec chmod 644 {} +

# nginx: index files, an admin allow list and a dotfile rule
server {
    root  /var/www/site;
    index index.html index.php;

    location /admin/ {
        allow 192.0.2.0/24;    # office range
        deny  all;
    }

    location ~ /\.(?!well-known/) { deny all; }   # .git, .env; keeps ACME challenges working
}

05How do I fix a 403 Forbidden in Apache?

Apache 2.4 tags each reason with a message ID; on Debian and Ubuntu the log is /var/log/apache2/error.log. The IDs below were reproduced on Apache 2.4.68.

After an upgrade from 2.2, old access syntax is the usual cause. Require replaced Order, Allow and Deny: Deny from all became Require all denied, and Allow from all became Require all granted. Old lines still work through mod_access_compat and log AH01797 when they deny, but the upgrade guide warns against mixing the two styles. An .htaccess file in any parent directory can add rules of its own.

grep -E 'AH01630|AH01797|AH01276|AH00035|AH00132' /var/log/apache2/error.log | tail -n 20

<Directory /var/www/site>
    Require all granted
    DirectoryIndex index.html index.php
    Options -Indexes
    # ignore .htaccess files unless the site relies on them
    AllowOverride None
</Directory>

<Location /admin/>
    Require ip 192.0.2.0/24
</Location>

06What if the 403 comes from a WAF or CDN?

An edge returns 403 when one of its rules stops a request before the origin: a managed rule, a custom rule, a country or address block, or a bot rule. The origin never sees these requests, so its logs stay empty and nothing changed there will help.

Take the reference ID from the block page, find the event in the provider's security log and read which rule fired. For a false positive, narrow the rule for that path or parameter instead of switching it off. CloudFront's documentation notes that when its WAF is in use, it cannot tell a WAF 403 from an origin 403, so check the WAF log first.

Behind a proxy, the origin sees the proxy's addresses unless it restores the visitor's from a trusted header, so an office allow list can lock everyone out. The X-Forwarded-For guide explains which header to trust.

• A WAF can refuse attack patterns, blocked countries or networks and rule violations before they cost the origin anything
• A WAF can show the owner which rule blocked a request, the fastest way to settle a false positive
• A WAF cannot fix a 403 the origin sends for permissions, index files or roles
• A WAF cannot decide which users may see a page; that decision stays in the application

07Do 403 errors hurt SEO?

They can, if search engines receive them. Google's crawling documentation says URLs that return a 4xx code are not indexed and indexed ones are removed, and it advises against using 401 or 403 to slow crawling, because 4xx codes other than 429 have no effect on crawl rate. Make sure firewall and bot management rules let verified search crawlers through.

Caches rarely keep a 403. RFC 9110 does not list it among the heuristically cacheable codes, so a shared cache stores one only when the response explicitly allows it, for example with Cache-Control: max-age. Some CDNs apply their own defaults to error codes, so check the provider's documentation if a fixed 403 seems to linger.