The 403 Forbidden error means the server understood the request but refuses to execute it. Unlike 401 (authentication required), 403 indicates access is denied even with credentials.
Causes are usually related to file permissions, server configuration, or security rules. This guide helps you identify and resolve the problem.
Main Causes
- File permissions: Web server doesn't have read rights on files or folders.
- Missing index: No index.php/html in a folder, and directory listing disabled.
- .htaccess rule: A "Deny from all" directive or equivalent blocks access.
- WAF/Firewall: A web application firewall (ModSecurity, Cloudflare) blocks the request.
Diagnosis
- Check permissions: ls -la to see permissions. Web server must be able to read files.
- Test without .htaccess: Temporarily rename .htaccess to see if it's the cause.
- Server logs: Logs often show the exact reason for denial.
Solutions
- Fix permissions: chmod 755 for folders, chmod 644 for files. chown www-data:www-data.
- Add an index: Create an index.php/html file or enable Options +Indexes if appropriate.
- Modify .htaccess: Remove or correct Deny rules that block access.
Frequently Asked Questions
What difference between 401 and 403?
401 = authentication required (identify yourself). 403 = access denied even when identified (you don't have rights).
Can Cloudflare cause 403s?
Yes, Cloudflare security rules (JS challenge, country blocking) can return 403. Check Firewall Events.
A 403 on wp-admin, what to do?
Often caused by .htaccess protection or security plugin. Check allowed IPs and blocking rules.
How does MoniTao handle 403?
MoniTao alerts you on 403 errors on your monitored pages. You can define if 403 is an error or expected behavior.
Ready to Sleep Soundly?
Start free, no credit card required.