The 403 error code, called Forbidden, means the server found the page and understood your request, but it refuses to let you in. This is different from a missing page. The file is there, and the answer is a firm no. Signing in again does not always help, because the rule may depend on your account type, your network or your country.
You can meet it as "403 Forbidden", "Access Denied", "You don't have permission to access this resource" or "Error 403". Start with the quick checks below, which clear a surprising number of cases, then read about permissions if you run the website.
Common causes
1Your account lacks permission
How to tellYou are logged in, yet only some pages say forbidden
What fixes itAsk the page owner or admin to grant your account access
2Not logged in with the right account
How to tellAnother saved account opens by default
What fixes itSign out, then sign in with the account that has access
3VPN, proxy or shared network is blocked
How to tellPage opens on mobile data but not on office or VPN connection
What fixes itDisconnect the VPN or switch network
4Website blocks your region or IP address
How to tellOnly that site shows 403 and others load fine
What fixes itTry a different network; owner can review the block list
5Folder or file permissions set wrongly
How to tellWhole site or a folder gives 403 after an upload or move
What fixes itOwner sets correct permissions and an index file
6Security rule triggered by a firewall
How to tellFails right after a form or search with odd characters
What fixes itOwner checks the firewall log and relaxes the rule
How to fix it, step by step
Check that the address is right
A web address that ends in a folder name, without a page, may be set to forbid a file listing. Add the page name, or go to the site's home page and use its menu.
Reload and clear the site's cookies
On a computer, Ctrl + Shift + R forces a full reload. Then remove cookies for that one site and open it again, since a damaged cookie can trigger a 403.
Log out and sign in with the right account
Many people hold two accounts. Sign out of all, then sign in with the one that was given access. Work and school portals especially refuse personal accounts.
Turn off the VPN or change network
Many sites refuse traffic from VPN servers and busy shared networks. Disconnect, then try on mobile data. If it opens, your earlier network was the blocked one.
Check your phone or PC date and time
A wrong device clock can make secure requests fail their checks. Let the device pick its own date and time, then reload.
Try another browser or a private tab
Add ons that block scripts or change headers can lead to a 403. A private tab, which runs without them, will show if one is responsible.
Request access
If you are meant to see the page, send the owner the address, your account name and the time. For work files, your admin can adjust sharing in minutes.
What the 403 error code means
Status codes beginning with 4 blame the request. A 403 is the "you may not" code. The server knows exactly what you asked for and has decided you are not permitted, whether because of who you are, where you are connecting from or how the folder is set. The server is allowed to hide the existence of a page by sending 404 instead, so a 403 usually means the owner did not mind admitting that it exists.
You open a shared document link and read 403 Forbidden. You don't have permission to access this resource. The owner shared it with another email address. Ask them to add yours.
403 versus 401 and 404
| Code | What happened | Best next step |
|---|---|---|
| 401 | Server needs you to sign in | Log in |
| 403 | Signed in or not, access refused | Request permission or change network |
| 404 | Nothing found at that address | Check spelling or search the site |
See the pages on 401 Unauthorized and 404 Not Found, or return to the HTTP status codes hub.
Forbidden status in a REST API
For developers, a 403 means the API key or token was accepted but lacks the rights for that action, such as a read only key trying to delete. Check the role or scope assigned to the credential, the allowed address list, and any quota or plan limit. If the server does not recognise the credential at all, you would expect a 401 instead.
For website owners: permissions that cause 403
- Folders normally need 755 and files 644. Stricter values can block the server from reading them.
- A folder without an index page and with listing disabled returns 403.
- A bad rule in the server configuration or
.htaccessfile may deny everyone. - Security plugins and firewalls block patterns that look like attacks, and sometimes block real visitors.
- Hotlink and country blocks return 403 on purpose.
Back up before editing server files. Wrongly loosening permissions on a live site, such as setting everything to 777, is unsafe.
Frequently asked questions
What does error code 403 mean?
It means the server understood your request but refuses to allow it. The page exists, but your account, network or location is not permitted to view it.
How to fix 403 forbidden error in a browser?
Reload fully, clear cookies for the site, sign in with the right account, switch off the VPN and try mobile data. If none works, ask the owner for permission.
Is 403 my fault or the website's fault?
It can be either. A blocked VPN or the wrong account sits with you, while a mistaken block or bad folder permission sits with the site. A test from a second network shows which.
Why does a 403 appear only on one network?
The site or its security tool may block that network's address range, often because many users share it. Switching to mobile data usually shows this.
Can I bypass a 403 error?
Not in a proper way. A 403 is a deliberate refusal, so the right path is to request access. Trying to get around it may break the site's terms.