What does 403 Forbidden mean?

RFC 9110 defines it as: the server understood the request but refuses to fulfill it. Unlike a 401, logging in again won't help, because the refusal is about permissions or rules on the server, not missing credentials.

What is the difference between 401 and 403?

A 401 means valid authentication credentials are missing, and the server must say how to authenticate. A 403 means the server refuses the request even if you are authenticated. MDN sums it up: for a 403, authenticating or re-authenticating makes no difference.

Can a 403 hurt my SEO?

Yes, if Googlebot gets it. Google treats a 403 like a 404: it doesn't use the content, removes URLs that were already indexed, and crawls them less often over time. A firewall rule that returns 403 to Googlebot can quietly remove pages from search.

Should I return 403 to slow down Googlebot?

No. Google says 4xx codes other than 429 have no effect on crawl rate, and specifically tells site owners not to use 401 or 403 for that. A 403 removes pages instead of slowing crawling. If the server is overloaded, return 503 or 429 temporarily.

Why do I get 403 on my site but my visitors don't?

Usually a firewall, CDN or security plugin rule matched your IP address, country, VPN or browser. Check the firewall's event log for your IP and the rule that fired. The same kind of rule can match search engine or AI crawlers, which is why you should test them too.

403 Forbidden Error: Causes, Fixes and SEO Impact

403 Forbidden is the HTTP status code a server sends when it understands the request and refuses to fulfil it. Logging in again won't help: the cause is a rule or permission on the server, such as file permissions, a missing index file, a firewall or CDN bot rule, or an IP block. If search engine crawlers get a 403, Google treats the page like a 404 and drops it from the index.

Key takeaways

403 means "refused", 401 means "not authenticated", 404 means "not found". A server may send 404 instead of 403 to hide that a resource exists.
Google removes indexed URLs that return 403 and gradually crawls them less.
The most damaging 403s are the ones only bots see, from firewall or CDN rules. Test with a crawler's user agent, not just your browser.
Returning 403 does not slow Googlebot down; it removes pages. Use 503 or 429 for temporary overload.

403 vs 401 vs 404

RFC 9110 defines the three codes this way:

Code	RFC 9110 meaning	What the visitor should do
401 Unauthorized	The request "lacks valid authentication credentials for the target resource"	Log in
403 Forbidden	"The server understood the request but refuses to fulfill it"	Nothing; logging in again won't change it
404 Not Found	The server "did not find a current representation for the target resource or is not willing to disclose that one exists"	Check the URL

RFC 9110 also says a server that wants to hide that a forbidden resource exists "MAY instead respond with a status code of 404." MDN puts the 401 and 403 difference plainly: for a 403, "authenticating or re-authenticating makes no difference."

How Google treats a 403

Google's page on HTTP status codes in Search groups 403 with 400, 401, 404, 410 and 411. Google doesn't use the content, "URLs that are already indexed and return a 4xx status code are removed from the index", and crawl frequency for those URLs gradually drops.

Google also says not to use 401 or 403 to limit crawl rate, because 4xx codes other than 429 don't affect it. In Search Console, these pages show up in the Page indexing report as "Blocked due to access forbidden (403)".

Common causes and how to fix each one

Cause	How to recognise it	Fix
File or folder permissions	403 on specific files or a whole folder after an upload or deploy	Give the web server user read access to files and execute access to folders
No index file in a folder	403 when you open a folder URL such as `/images/`	Add an `index.html` or matching index file, or link to the actual page
Firewall, CDN or security plugin rule	403 only for some visitors, countries, IPs or bots; often a branded block page	Find the rule in the firewall's event log and allow the request
IP or country block	Works on mobile data, fails on office Wi-Fi or a VPN	Remove or narrow the block; check allowlists
Hotlink protection	Images return 403 when embedded on another site or opened from a link	Add the referring domain to the allowed list, or accept the block if intended
Application permissions	Logged-in user gets 403 on an admin page or API call	Grant the role in the application, as in MDN's insufficient-permissions example

Missing index file

When a URL maps to a folder, the server looks for an index file such as index.html. Apache's Options documentation says that with Indexes turned on, mod_autoindex returns a listing of the folder instead. With directory listings turned off, which is the safer setting, servers commonly refuse the request with a 403. The fix is to add the index file, not to turn listings on.

Firewall and CDN rules that block crawlers

This is the 403 that costs rankings, because the site looks fine in your browser. Bot-management rules, rate rules and security plugins can match Googlebot, Bingbot or AI crawlers and serve them a 403 or a challenge page.

Check three places:

Search Console. Look for "Blocked due to access forbidden (403)" in the Page indexing report, and run URL Inspection's live test on an affected page.
The firewall's event log. Filter by the crawler's user agent and see which rule fired.
AI crawler settings. Some CDNs offer one-click blocking of AI crawlers. Cloudflare's Block AI bots setting, for example, "blocks verified bots that are classified as crawling for the purpose of AI training." If you want to appear in AI answers, check which bots a rule covers before turning it on.

To allow real Googlebot without opening the door to fakes, verify it the way Google describes in Verifying Googlebot: run a reverse DNS lookup on the IP, confirm the host is under googlebot.com, google.com or googleusercontent.com, then run a forward lookup to confirm it resolves to the same IP. Google also publishes its crawler IP ranges, for example in common-crawlers.json.

Our free AI crawler checker shows which AI crawlers your robots.txt allows or blocks. Remember that robots.txt and a firewall are separate: a crawler allowed in robots.txt can still get a 403 from the firewall.

IP, country and hotlink rules

A country block meant for spam traffic also blocks crawlers and customers in that country. Narrow it to the paths under attack, such as login and checkout, instead of the whole site. For hotlink protection, list every domain that legitimately embeds your images, including your own CDN hostname and any subdomains.

How to troubleshoot a 403 step by step

Reproduce it from the command line: curl -I https://example.com/page. Then repeat with a crawler user agent: curl -I -A "Googlebot" https://example.com/page. Different results point at a bot rule.
Try another network (mobile data or a VPN) to rule out an IP block on your own connection.
Read the response body. CDNs and security plugins usually brand their block pages, which tells you which layer sent the 403.
Check the server's error log for permission or directory errors on that path.
After the fix, request indexing for the affected URLs in Search Console.

If the page has moved rather than been blocked, use a redirect instead; see 301 vs 302 redirects. For every other status code and how Google handles it, see our HTTP status codes guide.

Sources

RFC 9110, sections 15.5.2, 15.5.4 and 15.5.5: definitions of 401, 403 and 404.
MDN: 403 Forbidden: the 401 and 403 difference, insufficient-permissions example.
Google Search Central: How HTTP status codes affect Google Search: how Google treats 403 and crawl rate.
Google Search Central: Verifying Googlebot: reverse and forward DNS checks, published IP ranges.
Apache HTTP Server: Options directive and Cloudflare: Block AI bots.

403 Forbidden: what it means, why it happens and how to fix it