Client errors (4xx)

403 Forbidden

The server refuses to show this page.

Quick answer

A 403 means the server understood the request but will not allow it. The website is online. Security rules, missing permissions or country blocks often cause it, and automated checks are blocked more often than people.

When to wait: A block usually stays until the rule changes; waiting rarely helps.

If you are visiting the website

Reload once and check the address Reload the page one time. Then check the address for typos or an extra folder name at the end.
Compare in your own browser Open the website yourself. Our check comes from one measuring point and may see something different from you, because many sites block automated checks more strictly than people.
Sign in, then try again If the page belongs to an account area, sign in first. If you are signed in and still see 403, your account probably has no access to this page. Only the website can change that.
Turn off your VPN or proxy briefly Some sites block addresses used by VPNs (services that hide your location), proxies or data centres. Turn the VPN off once to test, then turn it back on. If the site only works without it, the block is the site's choice.
Clear this site's cookies only A broken or outdated cookie (a small file the site stores in your browser) can trigger a security rule. Delete the cookies and saved data for this one website, not for all websites. Your other logins stay intact.
Windows
Chrome: click the site-information icon left of the address, then Cookies and site data > Manage on-device site data, and delete this site. Edge: Settings and more > Settings > Cookies and site permissions > Manage and delete cookies and site data > See all cookies and site data, search the site, delete. Firefox: click the padlock > Clear cookies and site data.
macOS
Chrome: site-information icon left of the address > Cookies and site data > Manage on-device site data. Safari: Safari > Settings > Privacy > Manage Website Data, select the site, click Remove.
Android
Chrome: tap Page info at the left of the address bar > Cookies and site data > Delete.
iPhone and iPad (iOS)
Safari: Settings > Apps > Safari > Advanced > Website Data (older iOS: Settings > Safari > Advanced > Website Data), swipe left on the site and tap Delete.
Contact the website If the page should be open to you, write to the website through another channel. Send the full address, the time with your time zone and your country. Their security logs can show which rule blocked you.

If you run the website

Find the rule that blocked the request Search your firewall, CDN (content delivery network, such as Cloudflare) and bot-protection logs for the time and visitor address. Most tools name the exact rule that matched.
Narrow rules that hit real visitors If a rule blocks whole countries, VPN ranges or common browsers, make it more specific. Where you can, use a challenge page or a rate limit instead of a hard block.
Do not use 403 for rate limiting Google advises against answering crawlers with 403 or 404 to slow them down. Use 429 or 503 for overload, so search engines retry later instead of treating pages as forbidden.
Check file and folder permissions The web server user must be able to read the files and open every folder on the path. On Linux, namei -l /path/to/file lists the permissions of each folder on the way.
Check the index file and access rules For folder addresses the server looks for an index file, set by index in nginx or DirectoryIndex in Apache. Also look for deny rules in the server config and in .htaccess files. Test with sudo nginx -t or apachectl configtest before reloading.

Is it the website or me?

A 403 comes from the website's own server, so the site is online. The real question is whether the block is aimed at everyone or only at you.

If the page works on mobile data but not on your Wi-Fi or VPN, your network address is probably blocked. If it fails on every network and device, the page is closed or the server is set up wrongly.

How 403 differs from 401

A 401 means "sign in first": the server wants valid login details. A 403 means "no", even when the server knows who you are.

Signing in again usually does not help with a 403. Sending the same request unchanged will give the same answer.

For developers: what happens technically

The server received and understood the request but decided not to fulfil it. Common sources are a web application firewall (a filter for suspicious requests), access rules in the server config, or missing read permissions.

The response body often names the blocking product or a reference ID. Match that ID against your logs to find the rule.

Common questions

Is a 403 error my fault?

Usually not. It is a rule on the website's side. It can be linked to your network, VPN or country, but only the site can change the rule.

Will clearing cookies delete my passwords?

No. Clearing cookies for one site signs you out of that site, but saved passwords stay in your browser's password manager. You just sign in again.

Why does the site work on my phone but not on my computer?

The two devices may use different networks, VPNs or stored cookies. Clear that site's cookies on the failing device and compare on the same network.

Why does CheckWebsiteNow report a 403 when the site works for me?

Our check comes from one server, and many sites block automated visitors more strictly than people. That is why we call it a restricted check, not an outage.

Likely causes

Common A firewall or bot protection blocks this request. (Website side)
Sometimes File or folder permissions on the server are wrong. (Website side)
Sometimes Your network, VPN or country is blocked. (Your side)

What to avoid

Do not make all files writable for everyone to fix permissions; give only the access that is needed.
Do not try to get around a block with tools or tricks the site does not allow; ask the site instead.

Is the website down? Check it now

One measurement point. Results explain what we saw, not a worldwide verdict.

Sources

Last reviewed: 2026-10-06