HTTP 403 Forbidden

Client error code, RFC 9110, section 15.5.4

What it means

The server understood the request but refuses to do it. Signing in again will not help if you are already signed in: the answer is no.

A real response

This is the request and the answer our test server gave when we asked it to return 403.

GET /c/403 HTTP/1.1
Host: example.com

HTTP/1.1 403 Forbidden
Date: Sat, 14 Nov 2026 10:00:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 11

<p>demo</p>

If you run the site

Common causes: file or folder permissions on the server, a firewall or security rule that blocks the visitor's address or country, a missing index file in a folder that has directory listing off, or a user without the needed role. Check the server error log: it usually says which rule blocked the request. Some sites use 404 instead of 403 to avoid saying that a page exists.

If you are a visitor

Check you are signed in with the right account. A VPN or a shared network address can also be blocked by a site's rules; try without it.

A common mistake

Fixing a 403 by making files writable by everyone. Fix the owner and the rule instead.

Registered in the IANA HTTP Status Code Registry as Forbidden, defined in RFC 9110, section 15.5.4.

This is an independent guide. It is not connected with the IETF, IANA, any browser maker or any company named here. Meanings were checked against the RFC texts on 14 November 2026. Responses shown were recorded on 14 November 2026 from a small test server on the author's own computer.