403 error (Forbidden)

The 403 error (Forbidden) is an HTTP status code meaning the server understood the request perfectly well but refuses to fulfill it: access to the resource is denied, and unlike the 401 error, presenting credentials again will not change the outcome. The server knows who is asking — and deliberately says no.

How the 403 error works

A 403 can be produced by the web server itself or by any intermediate layer. The usual causes are:

• wrong file or directory permissions (the web server process cannot read the file; 644 for files and 755 for directories is the norm) or incorrect file ownership,
• deny rules in an .htaccess file or in the server configuration,
• a web application firewall such as ModSecurity classifying the request as an attack — false positives on form submissions are common,
• IP address or country-level blocking (geoblocking) and hotlink protection,
• a directory listing request where no index file exists and autoindexing is disabled.

Practical applications

Diagnosis should begin with the server's error log, which usually names the exact rule or file responsible for the denial. From there, verify permissions and ownership, inspect .htaccess sections added by security plugins, and review WAF rules and IP blocklists in the hosting panel. It is worth remembering that 403 is often intentional and correct: administrators use it to protect admin panels, backup directories and API endpoints restricted to specific networks. In those cases the status code is evidence of security working as designed — not a fault to repair.