403Forbidden
403 Forbidden means the server understood the request but refuses to fulfill it. The credentials may be valid; they are simply not enough. Repeating the same request with the same credentials will not help.
What does it mean?
The server can explain why in the response body, but it is not required to. It may also return 404 instead of 403 to hide whether a resource exists.
If credentials were supplied, the server considers them insufficient. A different account or a different permission may work; a retry with the same one will not.
When does it happen?
- The user role does not include this action.
- An IP address, country, or user agent is blocked.
- File or directory permissions deny the web server.
- A WAF or bot rule rejects the request.
How do you fix it?
If you run the server
- Check roles, scopes, and resource ownership before changing the status code.
- Do not ask the client to re-authenticate automatically; a new login will not fix a permission problem.
- If the existence of the resource is sensitive, 404 is a legitimate alternative.
If you are just visiting
- Use an account with the right permission, or ask the site owner.
- Do not keep retrying; the same request will keep failing.
