403 Forbidden
Web/HTTP
Low severity
HTTP 403 — Forbidden
The server understood the request but refuses to authorize it — permissions, IP blocking, a WAF rule, or a missing index file.
Last reviewed 2026-08-29 by the Tech Issue Guide team.
Symptoms
- “403 Forbidden — You don’t have permission to access this resource.”
- The site works on mobile data but not on your home or office network (or vice versa).
- On your own site, a folder shows 403 instead of its page.
What causes 403 Forbidden
- You are not logged in with an account that has access, or a paywall/geo-restriction applies.
- Your IP address is blocked by the server, a firewall, or a WAF rule.
- On a site you host: wrong file/folder permissions or no index file in the directory.
- A .htaccess or server-config “deny” directive.
How to fix it — 3 steps
- Confirm you are signed in with an authorized account; try the URL from another network, since many blocks are IP-based.
- For a site you control, set directory permissions to 755 and file permissions to 644, and make sure an index file exists.
- Review .htaccess, server config and any WAF/CDN firewall rules for deny entries or bot rules catching you.
Terminal / CLI command
curl -sSI "https://example.com/path/"The response headers often reveal the source — e.g. a “Server: cloudflare” 403 points at a CDN firewall rule.
How to confirm the fix: The resource loads for an authorized user from a normal network.
Prevent it from coming back
Keep firewall/WAF rules narrow, and always ship an index file with public directories.
Frequently asked questions
Cloudflare shows the 403 — what does that mean?
A CDN/WAF rule (or the site owner’s security setting) blocked the request before it reached the origin. The site owner can whitelist your IP or loosen the rule.