403 Forbidden means the server understood the request but refuses to authorize it. If credentials were sent, the server considers them insufficient, and the client should not simply repeat the request with the same credentials. The server may explain the reason in the body, or keep it to itself.
403 is also what many web application firewalls, CDNs and bot-protection systems return when they block a request because of its IP address, country, user agent or behaviour. Servers that do not want to reveal that a forbidden resource exists may answer 404 Not Found instead.
Use 401 when logging in would help, and 451 when access is blocked for legal reasons.
Example response
HTTP/1.1 403 Forbidden
Date: Fri, 06 Nov 2026 10:15:32 GMT
Server: Apache
Content-Type: text/html; charset=iso-8859-1
Content-Length: 198
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
</body></html>SEO and redirect checking
Search engines do not index URLs that return 403, and indexed URLs that start returning it are dropped like any other 4xx. Accidental 403s for crawlers are common, caused by firewall rules, bot protection or rate limits that block Googlebot's IP ranges or user agent. Google advises against using 401 or 403 to limit crawling; return 429 or 503 for a short time instead.
If a redirect check returns 403 while the page works in your browser, the site is probably blocking automated or data-centre traffic; TrueURL marks responses that look like a bot challenge. Try a different User-Agent preset, such as Googlebot, to see what crawlers get, keeping in mind that many sites verify the real Googlebot by its IP address.
Common causes and use cases
- A web application firewall or bot protection, such as a Cloudflare challenge, blocks the client.
- File system permissions prevent the web server from reading the file.
- Directory listing is disabled and the folder has no index file (for example
Options -Indexesin Apache). - Access is restricted by IP address, country or referrer, as with hotlink protection.