403 Forbidden

HTTP 403 Forbidden means that the server understood the request but refuses to fulfill it. The response does not necessarily explain why access was refused. A visitor may not have permission, or the server may block the request because of an access rule or security setting.

What does a 403 page mean for a visitor?

The address can exist and the server can be working, while the requested resource remains unavailable to that visitor. Signing in may help if the site requires an account, but it will not resolve every 403. The site owner might need to adjust permissions, a firewall rule that filters network traffic, or another access control.

For example, Priya opens example.com/private-report and sees 403. The response tells her that the server refuses this request; it does not prove that the report is missing or that the website is offline. If Priya believes she should have access, she can check the account she used or contact the site owner.

Is 403 the same as 401 Unauthorized?

They are related but different. A 401 Unauthorized response asks the browser or other client to provide valid proof of identity, such as by signing in. A 403 Forbidden response says the request is refused; valid credentials can still be insufficient to grant access. A site may also use 404 instead of 403 when it does not want to disclose that a restricted resource exists.

Related terms

• HTTP status code — explains status codes and their classes
• 404 Not Found — a resource may be missing or deliberately undisclosed
• HTTP — the protocol carrying the refusal response