Nginx

How to Fix 403 Forbidden Error in Nginx

A 403 Forbidden error in Nginx is usually caused by one of a handful of configuration problems. Work through the causes below in order - the first ones are the most common.

Common Causes in Nginx

• Incorrect file or directory permissions
• The Nginx user (www-data/nginx) cannot read the files
• Missing index file with autoindex off
• A deny rule in the Nginx configuration
• Wrong root or alias path
• SELinux blocking access on RHEL/CentOS

Step-by-Step Solutions

Solution 1: Fix File and Directory Permissions

1. Directories should be 755 and files 644: sudo find /var/www/site -type d -exec chmod 755 {} \;
2. sudo find /var/www/site -type f -exec chmod 644 {} \;
3. Make sure every parent directory is executable (755) so Nginx can traverse it

Solution 2: Fix Ownership for the Nginx User

1. Check the user Nginx runs as: grep 'user' /etc/nginx/nginx.conf (usually www-data or nginx)
2. Set ownership: sudo chown -R www-data:www-data /var/www/site
3. Reload Nginx: sudo systemctl reload nginx

Solution 3: Check for a Missing Index or Deny Rule

1. If the URL is a directory, ensure an index file exists or set: index index.html index.php;
2. Search your config for deny directives: grep -r 'deny' /etc/nginx/
3. Confirm the root/alias path points to the correct directory
4. Test and reload: sudo nginx -t && sudo systemctl reload nginx

Solution 4: Check SELinux (RHEL/CentOS/Rocky)

1. See if SELinux is enforcing: getenforce
2. Allow Nginx to read the web root: sudo chcon -R -t httpd_sys_content_t /var/www/site
3. For persistent rules use semanage fcontext, then restorecon
4. Review denials: sudo ausearch -m avc -ts recent

Prevention Tips

• Watch the Nginx error logs and alert on rising error rates
• Test configuration changes in a staging environment first
• Keep configuration under version control so you can roll back quickly
• Run a configuration test (e.g. nginx -t or apachectl configtest) before every reload