403 Forbidden — what it means and how to fix it
A 403 is the server answering “I know what you’re asking for, and no.” Unlike a 404 (doesn’t exist), the page or file is there — permission is the problem. Whether you can fix it depends on which side of the server you’re on.
The fix, in order
- Visitor: check the address. A 403 often guards a directory or an unfinished URL. Go to the site’s homepage and navigate from there instead of using a deep or partial link.
- Visitor: turn off your VPN and reload. Websites routinely refuse known VPN and datacenter address ranges — this alone explains many sudden 403s.
- Visitor: clear the site’s cookies/cache or try a private window. A stale session or a security cookie gone wrong can trip the site’s firewall.
- Owner: check file and folder permissions. The classic values: files 644, folders 755. Wrong ownership (files owned by a different user than the web server runs as) produces the same error.
- Owner: look for the block rule. An .htaccess deny rule, a missing index file in the directory (with listing disabled), or a WAF/ModSecurity rule matching the URL — your host’s error log names which one fired.
If it still happens
Owners on shared hosting: if the 403 began suddenly across the whole site, suspect an auto-installed security plugin update or the host’s own firewall before your files — the host’s status page and a support ticket answer that faster than file surgery.
Common questions
Is 403 an error on my computer? No — it’s the server making a decision. Your side of the fix is limited to the address, your VPN, and your browser state (steps 1–3).
What’s the difference between 401 and 403? 401 means “log in first” — authentication missing. 403 means “even knowing who you are, this isn’t allowed” — authorization missing.
Related errors