4xx Client errors

HTTP 403 Forbidden

HTTP 403 Forbidden means the server knows who you are, or does not care, and refuses the request anyway.

What 403 Forbidden means

A 403 is about authorization: the user is logged in but lacks the role, or the resource is blocked for everyone (for example by a firewall or a directory with no index). Retrying with the same credentials will not help.

Common causes

  • A role or ownership check failed (a user editing another user's data).
  • A WAF, CDN or bot protection rule blocked the request.
  • File-system permissions on a static server.

How to fix or use it

Check permissions on the server for every request (never trust the client UI). For resources the user should not even know exist, return 404 instead of 403 to avoid leaking their existence.

Express (Node.js) example

function requireRole(role) {
  return (req, res, next) =>
    req.user?.roles.includes(role) ? next() : res.status(403).json({ message: 'Forbidden' });
}
app.delete('/api/users/:id', requireAuth, requireRole('admin'), deleteUser);

SEO impact

If a CDN or bot filter answers 403 to Googlebot, pages drop out of the index. Check Search Console URL Inspection after enabling bot protection.

Other 4xx Client errors codes