403

403 Forbidden is an HTTP status code that indicates the server understood the request but refuses to authorize it. Unlike the 401 Unauthorized status, which signals that authentication is required or has failed, a 403 response means that providing valid credentials will not grant access. In short, the client’s identity may be recognized, but access to the requested resource is explicitly denied by policy or configuration.

Common causes include strict permission rules on the resource, missing or insufficient user rights, IP blocking, geolocation restrictions, or application-level access controls. Some servers provide substatus information under the 403 family to indicate more specific reasons, such as access being denied due to policy or configuration settings.

Examples include attempting to reach an admin-only page without the necessary privileges, or trying to access a file that is protected by access controls. A website may also return 403 in response to automated requests that appear unauthorized or suspicious.

Handling and troubleshooting typically involve verifying authentication and authorization requirements, checking user roles and permissions, and reviewing server configuration and access control lists. Web server software (for example, Apache, Nginx, or IIS) uses different modules and directives to enforce access rules; incorrect permissions, misconfigured deny rules, or failing authorization checks are common sources of 403 errors. It is also important to ensure that error messages do not disclose sensitive information.

In the HTTP specification, 403 is a defined, authoritative response for forbidden access and is distinct from other client errors such as 401 or 404.