SaveForMeNow
EN
Remove background
ImageCompress imageResize imageCrop imageSocial media resizerInstagram without croppingConvert imageHEIC to JPGAVIF to JPGUpscale imageAI photo enhancerDPI checkerPassport photo makerRemove watermarkWatermark imageRotate & flipRemove photo locationSee all image tools →
PDFMerge PDFSplit PDFOrganise PDFCompress PDFEdit PDFSign PDFAdd page numbersWatermark PDFProtect PDFUnlock PDFJPG to PDFPDF to WordWord to PDFPDF to ExcelExcel to PDFPDF to JPGSee all PDF tools →
Video & AudioCompress videoTrim videoConvert videoMerge videosVideo to GIFRotate videoCrop videoChange speedMute videoVideo to textScreen recorderVideo to MP3Trim audioRingtone makerMerge audioVoice recorderSee all video and audio tools →
MoreAdd text to imageMeme makerCollage makerFavicon generatorWord counterCase converterPassword generatorJSON formatterPercentage calculatorUnit converterTime zone converterQR code scannerQR code generatorSee all design tools →
GuidesVideo downloader

Guides

How to fix a 403 Forbidden error

Website errorsUpdated 29 October 20262 min read

Short answer: 403 means the server understood the request but won't allow it. On your own site, check file permissions (folders 755, files 644), make sure the folder has an index file, then look at .htaccess rules, security plugins and firewall or IP blocks. Visitors can only try reloading, another network or turning off a VPN.

What visitors can try

Causes and fixes for site owners

1. Wrong file permissions

Most Linux hosts expect folders at 755 and files at 644. A file set to 600 can't be read by the web server, and some hosts refuse 777. Fix permissions in your host's file manager or over FTP.

2. No index file

When you open a folder address such as /shop/, the server looks for index.html or index.php. If there isn't one and directory listing is turned off, which is the safe setting, you get a 403. Upload the index file or link to the actual page.

3. .htaccess rules

Rules such as Deny from all or Require all denied, or a wrong rewrite, block access. Rename .htaccess temporarily to test. If the page loads, fix the rule that blocks it.

4. Security plugins and firewalls

WordPress security plugins, a web application firewall (WAF) or Cloudflare can block requests that look suspicious. Common triggers are submitting forms with code in them, very fast requests, or certain countries. Check the plugin's or firewall's block log for your IP and the rule that fired.

5. Hotlink protection and referrer rules

If images show 403 only when used on another site, hotlink protection is doing its job. Add the other domain to the allowed list if you trust it.

6. Wrong file owner after a migration

After moving a site, files can end up owned by the wrong user. Ask your host to reset ownership for your account.

A quick check order

  1. What changed last? Undo it.
  2. Check the server error log. It usually names the rule or file.
  3. Check permissions on the folder and file.
  4. Rename .htaccess to test.
  5. Pause security plugins and the firewall to test.

Related: 500 Internal Server Error and 404 Not Found.

Questions

What's the difference between 401 and 403?

401 Unauthorized means you need to log in. 403 Forbidden means that even when logged in, you're not allowed.

Can a 403 be caused by my browser?

Rarely. Bad cookies or an extension can trigger a site's security rules. Try a private window without extensions.

Will a 403 remove my pages from Google?

If Googlebot keeps getting 403 for a page, the page drops out of results. Make sure your firewall doesn't block search engine crawlers.