403 Forbidden

What causes it

• The user is logged in but lacks the permission or role.
• Filesystem permissions on a static file the web server cannot read.
• Directory listing is disabled and there is no index file.
• A WAF, bot rule or IP allowlist blocked the request.
• S3: the object exists but the bucket policy denies it — or the object does not exist and the bucket hides that with 403.

How to fix it

• Distinguish it from 401: 401 means "who are you?", 403 means "I know who you are and no".
• For static files, check ownership and mode (`chmod 644` for files, `755` for directories) and SELinux context if applicable.
• For a CDN or WAF, look at the request ID in the response headers and find it in the edge logs.

Other 4xx client error codes

• 400 Bad Request
• 401 Unauthorized
• 402 Payment Required
• 404 Not Found
• 405 Method Not Allowed
• 406 Not Acceptable
• 407 Proxy Authentication Required
• 408 Request Timeout
• 409 Conflict
• 410 Gone
• 411 Length Required
• 412 Precondition Failed
• 413 Content Too Large
• 414 URI Too Long
• 415 Unsupported Media Type
• 416 Range Not Satisfiable
• 417 Expectation Failed
• 418 I'm a teapot
• 421 Misdirected Request
• 422 Unprocessable Content
• 423 Locked
• 424 Failed Dependency
• 425 Too Early
• 426 Upgrade Required
• 428 Precondition Required
• 429 Too Many Requests
• 431 Request Header Fields Too Large
• 451 Unavailable For Legal Reasons
• 499 Client Closed Request

Back to the full HTTP status code reference