403 Forbidden

What This Error Means

The client does not have access rights to the content.

Server understood the request but refuses to authorize it.

Common Causes

• Insufficient permissions
• IP address blocked
• File permissions incorrect
• Directory listing disabled

How to Fix It (For Visitors)

• Contact administrator for access
• Check if you have necessary permissions

How to Fix It (For Developers/Admins)

• Check file/directory permissions (755 for directories, 644 for files)
• Review .htaccess rules
• Verify firewall/WAF settings
• Check Nginx/Apache configuration

Code Examples

Here's how to return a 403 status code in various programming languages:

Python (Flask)

from flask import Flask, jsonify

app = Flask(__name__)

@app.route('/endpoint')
def endpoint():
    return jsonify({"message": "Forbidden"}), 403

Node.js (Express)

const express = require('express');
const app = express();

app.get('/endpoint', (req, res) => {
    res.status(403).json({ message: 'Forbidden' });
});

PHP

<?php
http_response_code(403);
header('Content-Type: application/json');
echo json_encode(['message' => 'Forbidden']);
?>

Go

package main

import (
    "encoding/json"
    "net/http"
)

func handler(w http.ResponseWriter, r *http.Request) {
    w.Header().Set("Content-Type", "application/json")
    w.WriteHeader(403)
    json.NewEncoder(w).Encode(map[string]string{
        "message": "Forbidden",
    })
}

Java (Spring Boot)

@GetMapping("/endpoint")
public ResponseEntity<Map<String, String>> endpoint() {
    Map<String, String> response = new HashMap<>();
    response.put("message", "Forbidden");
    return ResponseEntity.status(403).body(response);
}

Ruby (Sinatra)

get '/endpoint' do
    status 403
    json message: 'Forbidden'
end

Browser Compatibility

Browser	Support	Notes
Chrome	✓ Full Support	All versions
Firefox	✓ Full Support	All versions
Safari	✓ Full Support	All versions
Edge	✓ Full Support	All versions

Official Specification

This status code is defined in RFC 7231 Section 6.5.3.

View on IANA HTTP Status Code Registry →