403 Forbidden

The server understood the request but refuses to authorize it. Unlike 401, re-authenticating will not help.

What It Means

The client's identity is known (or irrelevant) but they lack permission to access the resource. This is common with firewalls, WAFs, geo-blocking rules, and application-level permission systems. The server is explicitly denying access, not asking for credentials.

Common Causes

• WAF or CDN blocking the request. Cloudflare, AWS WAF, or similar services are rejecting the request based on rules, bot detection, or rate limiting.
• IP-based access restrictions. The server or firewall only allows requests from specific IP ranges.
• Directory listing disabled. The URL points to a directory and the server is configured not to show directory indexes.
• File permissions wrong on the server. The web server process does not have read permission on the requested file.
• Authentication valid but authorization failed. The user is logged in but their role or group does not have access to this resource.
• Hotlink protection. The server rejects requests where the Referer header does not match an allowed origin.

403 vs 401

401 Unauthorized means "you need to authenticate." The server does not know who you are and wants credentials. 403 Forbidden means "I know who you are and the answer is no." If the user is not logged in, prefer 401. If they are logged in but lack access, use 403.

How to Diagnose

Use the Probe tool to check the response from Cloudflare's edge and see if the 403 is IP or geo specific. Look for a cf-mitigated header in the response, which indicates a Cloudflare challenge page or block. Check the response body for clues: many WAFs include a block reason or reference ID. Review your server access logs for the deny rule that triggered.