DevToolsmith

HTTP 403 Forbidden

HTTP 403 Forbidden means the server understood the request but refuses to authorize it. The request contains an error or can’t be fulfilled. Retrying unchanged won’t help.

Class
4xx Client error
Standard
RFC 9110
Cacheable by default
No
Safe to retry
No
Go constant
http.StatusForbidden

What HTTP 403 means

The server knows who you are (or doesn’t care) and won’t allow the request. Logging in again won’t help. Unlike 401, repeating the request with the same credentials will always fail. Servers that don’t want to reveal that a resource exists may return 404 instead.

How to fix a 403 error

  • On nginx or Apache, check file permissions: the web server user needs read access to files and execute access to every parent directory.
  • A directory without an index file returns 403 when directory listing is off.
  • WAFs and CDNs (Cloudflare, AWS WAF) return 403 for blocked IPs, countries or bot-like requests. Check their logs.
  • On S3, a 403 often means the object doesn’t exist and the caller lacks s3:ListBucket permission.

Retrying

No. Fix the request first; sending it again unchanged will get the same response.

Example response

HTTP/1.1 403 Forbidden
Date: Wed, 21 Oct 2026 10:30:00 GMT
Content-Type: application/json

How to return 403

Node.js (Express)
res.status(403).json({ error: 'Forbidden' });
Python (FastAPI)
from fastapi import HTTPException

raise HTTPException(status_code=403, detail="Forbidden")
Go (net/http)
http.Error(w, http.StatusText(http.StatusForbidden), http.StatusForbidden)
nginx
location /private/ {
    return 403;
}

Related status codes

Other 4xx status codes

400 Bad Request · 401 Unauthorized · 402 Payment Required · 404 Not Found · 405 Method Not Allowed · 406 Not Acceptable · 407 Proxy Authentication Required · 408 Request Timeout · 409 Conflict · 410 Gone · 411 Length Required · 412 Precondition Failed · 413 Content Too Large · 414 URI Too Long · 415 Unsupported Media Type · 416 Range Not Satisfiable · 417 Expectation Failed · 418 I’m a Teapot · 421 Misdirected Request · 422 Unprocessable Content · 423 Locked · 424 Failed Dependency · 425 Too Early · 426 Upgrade Required · 428 Precondition Required · 429 Too Many Requests · 431 Request Header Fields Too Large · 444 No Response · 451 Unavailable For Legal Reasons · 499 Client Closed Request

See the full list of HTTP status codes.

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What does HTTP 403 Forbidden mean?

HTTP 403 Forbidden means the server understood the request but refuses to authorize it. The server knows who you are (or doesn’t care) and won’t allow the request. Logging in again won’t help. Unlike 401, repeating the request with the same credentials will always fail. Servers that don’t want to reveal that a resource exists may return 404 instead.

How do I fix HTTP 403?

On nginx or Apache, check file permissions: the web server user needs read access to files and execute access to every parent directory. A directory without an index file returns 403 when directory listing is off. WAFs and CDNs (Cloudflare, AWS WAF) return 403 for blocked IPs, countries or bot-like requests. Check their logs. On S3, a 403 often means the object doesn’t exist and the caller lacks s3:ListBucket permission.