HTTP Error 403: Forbidden - what is the solution?

With every request, a web server sends a client a status code to confirm the connection. While positive confirmations or pure information are simply processed and not displayed by a browser, error messages are displayed so that the visitor can understand the cause - for example, HTTP Error 400: Bad Request, Error 408: Request Timeout, Error 405: Method not allowed, or Error 403: Forbidden - and possibly find a solution. The HTTP Error 403 specifically means that the visitor is forbidden access to the desired webpage and therefore the web server rejects the request.

How does an HTTP Error 403: Forbidden occur?

The HTTP status code consists of three numbers, with the first number indicating the type of message. The official standard distinguishes between:

• 1XX: Informational details such as a change of protocol
• 2XX: Action successfully completed
• 3XX: Request redirected for various reasons
• 4XX: Client-side error occurred
• 5XX: Server-side error occurred

When a client requests a webpage, it contacts the server, which then sends it a status code and - if possible - the requested data. With codes 4XX and 5XX, this does not happen for various reasons. For example, HTTP Error 400 means there is an error in the syntax, Error 405 indicates the client is using an unsupported method, and Error 408 signifies exceeding the allowable wait time.

What does an Error 403: Forbidden indicate?

Error 403: Forbidden occurs when a browser requests a page that exists but, for some reason, the web server lacks permission to access it. While with Error 401: Unauthorized there is the possibility to identify oneself with a username and password, Error 403: Forbidden is a general restriction that cannot be easily bypassed. However, it can be interpreted in two different ways:

• Access is generally forbidden for everyone
• Access was denied for specific reasons but is theoretically possible

This distinction is important to find a solution for the error 403: Forbidden, as the causes in both cases are different. Unfortunately, the message is not specific in this regard, making the search potentially complex. Some webservers like Microsoft IIS therefore use their own error messages that do not comply with the official standard. They add detailed information to the error 403: Forbidden - for example, 403.2 for missing read permissions or 403.9 for too many concurrent users.

Where are the causes for the error 403: Forbidden?

Although officially it is a problem on the client side, this assignment is not as straightforward as it may initially seem. Such precise attribution is only possible with some status messages, including errors like 400, caused by the client, or error 405, indicating an origin on the server. In reality, error 403: Forbidden, like error 408 for example, can originate from both the client and the server. The most common reasons for it are:

• A necessary extension in the browser is missing or disabled
• A firewall blocks access, for example, due to the IP address or location
• Access rights on the server are incorrectly set
• The URL points to a protected directory instead of a readable file within it
• There are temporary reasons such as high visitor traffic
• Outdated files in the browser cache prevent access

The solution initially involves checking the URL precisely, taking into account the type of content. Subsequently, the cookies associated with the website and the browser cache should be cleared. If it is a personal website and the error 403: Forbidden persists, this is usually due to access rights in the file system. If this still does not lead to a solution, a temporary overload is likely. If the file is misconfigured on a foreign server, there is no other solution for a visitor than to inform the responsible administrator about the error 403.

Photo: Gerd Altmann from Pixabay