A 403 Forbidden error is one of the most misunderstood messages on the web. It feels like the site is broken — but here's the twist that changes everything: a 403 almost always means the site is up and running perfectly, it's just refusing to let you see this particular page. That single fact points you straight at the real fix. Here's what 403 actually means, what causes it, and how to clear it whether you're a frustrated visitor or the site owner.

What does 403 Forbidden actually mean?

A 403 means the server understood your request perfectly well — and deliberately refused to authorize it. The page (or resource) exists, the server is healthy, but something is telling it "don't serve this to this visitor." That's very different from a 404 (the page doesn't exist) or a 502/503 (the server itself is failing).

The practical takeaway: a 403 is usually not a sign the site is down. If you run the site through our live website down checker and it reports the site as UP while you're seeing a 403, that's expected — the server is fine, it's the permission that's blocked. Our guide on what HTTP status codes mean shows how 403 sits alongside the other common codes, and our explainer on whether a site is down for everyone or just you covers why a 403 so often means "up, but blocking you."

Common causes of a 403 Forbidden error

A 403 can come from either side of the connection. The usual culprits are:

  • You need to log in or lack permission for that specific page.
  • Your IP or region is blocked, sometimes via a VPN that the site rejects.
  • Corrupted cookies or cache are sending a bad or expired session.
  • Hotlink or bot protection is refusing automated or off-site requests.
  • (Owner side) Wrong file or folder permissions on the server.
  • (Owner side) An .htaccess rule, security plugin, or firewall denying access.
  • (Owner side) A missing index file with directory listing turned off.

Which fixes to try depends on which side you're on — so let's split it.

How to fix 403 Forbidden as a visitor

If you've hit a 403 on someone else's site, work through these in order:

  • Double-check the URL. A slightly wrong address can land you on a protected directory. Try navigating from the site's homepage instead.
  • Refresh and try again. Some 403s are momentary, especially right after logging in.
  • Clear your cookies and cache, or open the page in an incognito window. A stale or corrupted cookie is one of the most common visitor-side causes — this fixes it instantly in many cases.
  • Log in or check your account. If the page is members-only, you may simply need to sign in or have the right permissions.
  • Disable your VPN or proxy. Many sites block traffic from VPN IP ranges, returning a 403. Turn it off and reload.
  • Flush your DNS cache if you suspect you're reaching an outdated server — our step-by-step DNS flush guide covers every platform.

If none of that works, the block is deliberate and on the site's end — there's nothing more you can do but contact the site owner. Our checklist on fixing a site that's down for you but not everyone covers the remaining visitor-side edge cases.

How to fix 403 Forbidden as a site owner

If it's your site returning 403 to visitors who should have access, the cause is almost always a permission or configuration issue. Check these:

  • File and folder permissions. This is the number-one cause. Folders should typically be 755 and files 644. Incorrect permissions — especially after a migration or bulk upload — trigger 403s across the board.
  • The .htaccess file. A bad rule, a stray Deny from all, or a corrupted .htaccess will block access. Rename it temporarily to test; if the 403 clears, regenerate it (in WordPress, re-save your permalinks).
  • Missing index file. If a folder has no index.html or index.php and directory listing is disabled, the server returns 403. Add an index file or adjust the directory settings.
  • Security plugins and firewalls. A WordPress security plugin, a mod_security rule, or a WAF can block legitimate requests. Disable recent changes one at a time to find the culprit.
  • IP deny rules. Check that you haven't accidentally blocked a range that includes real visitors.
  • Ownership. Make sure the web server user actually owns the files it's trying to serve.

Once it's fixed, set up free uptime monitoring for your domain so you're alerted the moment your site starts returning errors — 403s included — before your visitors report them.

The bottom line

A 403 Forbidden error is a locked door, not a demolished building — the site is up, but access to that page is being refused. As a visitor, clear your cookies, try incognito, log in, and drop your VPN; if the block persists, it's the owner's call. As an owner, check your file permissions, .htaccess, index files, and security rules — the fix is nearly always one of those. Either way, remember the key insight: a 403 means up but blocked, which is exactly why knowing how to read a status code saves you from chasing an outage that isn't there.