403 Forbidden
The server refuses to allow this request
Seen in Browsers, APIs, nginx, Apache, CDNs
The server understood who you are, or does not care, and still refuses access to this resource.
Common causes
- The account or API key lacks permission for this resource.
- File or directory permissions stop the web server reading the file.
- A directory was requested with no index file and directory listing is off.
- A WAF, IP allowlist or geo block rejected the client.
How to fix it
- Check the user's role or the API key's scopes.
- Make the files readable by the web server user (e.g. chmod 644 files, 755 directories).
- Add an index file or request the full file path.
- Check firewall, WAF and IP restriction rules for the client's address.
Got a different message? Paste it into the error explainer.
Related errors
- 502 Bad Gateway · The proxy got a bad response from the server behind it
- 504 Gateway Timeout · The server behind the proxy took too long
- Error 520: Web server is returning an unknown error · Cloudflare got an empty or invalid response
- 429 Too Many Requests · You've hit a rate limit
- 400 Bad Request · The server could not understand the request
- 401 Unauthorized · The request needs valid credentials
- 404 Not Found · Nothing exists at this URL
- 405 Method Not Allowed · This URL does not accept that HTTP method
- 410 Gone · The resource was removed on purpose
- 414 Request-URI Too Large · The URL is longer than the server accepts
- 500 Internal Server Error · The application hit an error it did not handle
- 400 Bad Request: The plain HTTP request was sent to HTTPS port · Plain HTTP was sent to a port that expects TLS