HTTP 403 is an HTTP status code meaning access to the requested resource is forbidden. The server understood the request, but will not fulfill it, if it was correct.


HTTP 403 provides a distinct error case from HTTP 401; while HTTP 401 is returned when the client has not authenticated, and implies that a successful response may be returned following valid authentication, HTTP 403 is returned when the client is not permitted access to the resource despite providing authentication such as insufficient permissions of the authenticated account.[a]

Error 403: "The server understood the request, but is refusing to authorize it." (RFC 7231)[1]

Error 401: "The request requires user authentication. The response MUST include a WWW-Authenticate header field (section 14.47) containing a challenge applicable to the requested resource. The client MAY repeat the request with a suitable Authorization header field (section 14.8). If the request already included Authorization credentials, then the 401 response indicates that authorization has been refused for those credentials." (RFC 2616)[2]

The Apache web server returns 403 Forbidden in response to requests for URL[3] paths that corresponded to file system directories when directory listings have been disabled in the server and there is no Directory Index directive to specify an existing file to be returned to the browser. Some administrators configure the Mod proxy extension to Apache to block such requests and this will also return 403 Forbidden. Microsoft IIS responds in the same way when directory listings are denied in that server. In WebDAV, the 403 Forbidden response will be returned by the server if the client issued a PROPFIND request but did not also issue the required Depth header or issued a Depth header of infinity.[3]


A 403 status code can occur for the following reasons:[4]


Client request:[5]

GET /securedpage.php HTTP/1.1

Server response:[5]

HTTP/1.1 403 Forbidden
Content-Type: text/html

   <head><title>403 Forbidden</title></head>
      <p>You don't have permission to access /securedpage.php on this server.</p>

Substatus error codes for IIS

en.Wikipedia error message

The following nonstandard codes are returned by Microsoft's Internet Information Services, and are not officially recognized by IANA.[6]

See also


  1. ^ See #Substatus error codes for IIS for possible reasons of why a webserver may refuse to fulfill a request.


  1. ^ Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content. IETF. sec. 6.5.3. doi:10.17487/RFC7231. RFC 7231.
  2. ^ Nielsen, Henrik; Mogul, Jeffrey; Masinter, Larry M.; Fielding, Roy T.; Gettys, Jim; Leach, Paul J.; Berners-Lee, Tim (June 1999). "RFC 2616 - Hypertext Transfer Protocol - HTTP/1.1". doi:10.17487/RFC2616. Retrieved 2018-04-09.
  3. ^ a b "HTTP Extensions for Web Distributed Authoring and Versioning (WebDAV)". IETF. June 2007. Archived from the original on March 3, 2016. Retrieved January 12, 2016.
  4. ^ HTTP status code 402 How do I solve the problem with the 403 status code?
  5. ^ a b Example of "Client request" and "Server response" for HTTP status code 403
  6. ^ HaiyingYu (2023-02-23). "HTTP status code overview - Internet Information Services". Retrieved 2024-05-19.