TinyPingTinyPing

403 Forbidden: Check, Causes and Fixes

Check whether a URL returns 403 Forbidden to a visitor outside your network, with response time and redirects, then find the rule or permission blocking it. Enter a URL such as https://example.com.

Common causes of 403 Forbidden

File and folder permissions

The web server user (www-data, nginx or apache) must be able to read the file and enter every directory above it. After an upload over SFTP or a deploy with a different user, files often end up 600 or folders 700. Typical safe values are 644 for files and 755 for folders; nginx logs "(13: Permission denied)" when this is the cause.

No index file and directory listing off

Requesting a folder with no index.html or index.php, while directory listing is disabled, gives 403. nginx logs "directory index of ... is forbidden". Upload the index file, fix the index directive, or check that the deploy put the build output in the document root and not in a subfolder.

An .htaccess or server rule denies access

Apache's Require all denied, an old Deny from all, or a security plugin's .htaccess rules can block whole folders or specific IPs. On nginx, look for deny directives in the matching location block. Rename .htaccess temporarily to see whether it is the cause.

WAF or bot protection blocks the request

Cloudflare (error 1020 Access denied), Sucuri, Wordfence, ModSecurity and hosting firewalls block requests that match a rule: a country, an IP range, a user agent or a pattern in the URL. Real visitors may be fine while crawlers, link previews, uptime monitors and API clients get 403. Check the firewall's event log for the blocked request and add an exception for the traffic you want.

Amazon S3 or CloudFront access denied

S3 answers AccessDenied with 403 when the bucket policy or object ACL does not allow public reads, or when CloudFront's origin access settings do not match the bucket policy. S3 also returns 403 instead of 404 for a missing object when the caller lacks list permission, so a typo in the key can look like a permissions problem.

Hotlink protection or a missing token

Images and downloads protected against hotlinking return 403 when the Referer is another site or missing. Signed URLs from S3, CloudFront or a video host return 403 after they expire. Check whether the URL works with the referrer or token it is supposed to have.

How to troubleshoot a 403

  1. Enter the URL and click Check status to see whether outsiders get 403.
  2. Compare with your browser: if only one of you gets 403, suspect an IP, country or bot rule.
  3. Read the server error log or your firewall's event log for the request.
  4. Fix the permission or rule, then check again.

What does 403 Forbidden mean?

403 Forbidden means the server understood the request and refuses to fulfil it. The resource may well exist; you are just not allowed to have it, and sending the same request again will not change that.

It is often confused with 401 Unauthorized. A 401 asks for authentication: log in, send a token, and try again. A 403 means authentication either does not help or already happened and was not enough, for example a logged-in user without admin rights.

On websites, a 403 is more often a configuration mistake than a deliberate refusal. File permissions, a missing index file, a leftover deny rule or an aggressive firewall rule all produce the same response. Some servers return 404 instead of 403 on purpose, so they do not reveal that a private file exists.

Because so many 403s come from rules that look at who is asking, it helps to test from outside your own network. This checker requests the URL from TinyPing's server with no cookies, which is close to what a crawler or monitoring service sees.

2026/10/06 11:02:45 [error] 902#902: *118 open() "/var/www/site/index.html" failed
  (13: Permission denied), client: 203.0.113.7, server: example.com,
  request: "GET / HTTP/1.1"

When to check for a 403

After changing hosts or deploy users

Files copied with rsync or SFTP as a different user often keep the wrong owner or mode. Check the home page and a static asset after the move.

Tightening Cloudflare or Wordfence rules

A new firewall rule or country block can catch more than you meant. Check from outside your network that public pages still return 200.

Serving files from S3 or CloudFront

After changing a bucket policy or setting up origin access control, check that public objects load and private ones stay private.

Monitors and integrations reporting 403

If a payment provider, Google Search Console or an uptime monitor reports 403 but your browser works, a bot rule is the likely cause. Check here to reproduce it.

Check something else

Frequently asked questions

Why do I get 403 but my colleague does not?

The rule is probably based on IP address, country, VPN or browser. Corporate networks and VPN exit addresses are often on firewall block lists. Ask your host or check the firewall log for your IP.

Can a 403 come from Cloudflare instead of my server?

Yes. Cloudflare's firewall and bot rules answer with their own 403 page, often showing error 1020 and a Ray ID. If the page is Cloudflare-branded, look in Cloudflare's security events, not your server logs.

What permissions should WordPress files have?

Usually 644 for files and 755 for folders, owned by the account the web server runs as. wp-config.php can be stricter, such as 640 or 600, as long as PHP can still read it.

Is 403 better than 404 for private pages?

Both are valid. 403 is honest that the page exists. 404 hides it, which GitHub and many APIs do for private resources so outsiders cannot discover what exists.

Does a 403 hurt SEO?

Search engines do not index pages that return 403. That is fine for admin areas, but if public pages return 403 to crawlers because of a bot rule, they will drop out of search results.

Why does an uptime monitor get 403 when the site works?

Bot protection is blocking it because it is not a browser. Allow the monitor's user agent or IP in your firewall, or monitor a URL that is not behind the challenge.

One wrong rule can lock everyone out

A chmod during a deploy or a new firewall rule can block public pages without anyone on your team noticing. TinyPing checks every 5 minutes and alerts you when:

  • the URL returns 403 or another error code
  • the server stops responding
  • the page recovers after you fix it
Start monitoring free for 7 days

US$6.99 a month or US$47 a year per 50 monitors, team members free. 7-day free trial, no card needed.

Want alerts in team chat? Follow the guide for Slack or Google Chat.