403 Forbidden is an HTTP status code in the 4xx class. The server understood the request and refuses to process it. The resource exists, but this client is not allowed to get it.
At a glance
- Status code
- 403
- Class
- 4xx (client error)
- Duration
- persistent refusal, repeating with the same credentials changes nothing
- In Google
- treated like other 4xx except 429, content is not used, indexed URLs are removed
- Specification
- RFC 9110, section 15.5.4
Last checked:
How does 403 differ from 401 and 404?
A 401 Unauthorized response means the request lacks valid authentication credentials, and the server sends a WWW-Authenticate header. MDN states that for 403, authenticating or re-authenticating makes no difference, because the failure is tied to application logic such as insufficient permissions. Clients should expect the same request to fail again. RFC 9110 adds that a client should not automatically repeat the request with the same credentials.
Servers may answer 404 instead of 403 if they do not want to confirm that a resource exists. From outside, the two can therefore look the same.
What does 403 mean for SEO?
Google’s documentation treats all 4xx codes except 429 the same. Content from URLs with a 4xx code is not used, such URLs are not indexed and already indexed ones are removed. Google also says not to use 401 and 403 to limit the crawl rate, since they have no effect on it.
The Page indexing report in Search Console has its own status, “Blocked due to access forbidden (403)”. Google explains that Googlebot never provides credentials, so a 403 on a page you want indexed is returned incorrectly. Google suggests either admitting non-signed-in users or explicitly allowing Googlebot without authentication, after verifying its identity. Google describes how to verify requests that claim to come from its crawlers.
In day-to-day SEO work, 403 often shows up where server rules, firewalls or bot protection turn away crawlers while visitors see the page normally (assessment).
Example
GET /internal/report.pdf HTTP/1.1
Host: www.example.com
HTTP/1.1 403 Forbidden
Content-Type: text/html
The server knows the file but does not hand it to this client.
Common mistakes
- A firewall or bot protection turns Googlebot away. Visitors see the page while the crawler gets 403. Google describes how to verify whether a request really comes from its crawlers.
- Using 403 to limit the crawl rate. Google advises against using 401 and 403 for this because they have no effect on it.
- A page that should be indexed requires sign-in. Search Console reports “Blocked due to access forbidden (403)”. Googlebot never provides credentials, so 403 is the wrong response for a page meant to be indexed.
Frequently asked questions
Why do I get a 403? The server refuses access, for example because of missing permissions, blocked IP addresses or firewall rules. The cause sits on the server side.
Does 403 mean I am blocked? It can. The code states that access is refused for this request. The reason is up to the server.
Sources
- 403 Forbidden – MDN Web Docsdeveloper.mozilla.org
- RFC 9110: HTTP Semantics, section 15.5.4 (403 Forbidden)rfc-editor.org
- How HTTP status codes affect Google's crawlers – Google Crawling Infrastructure (2026-02-04)developers.google.com
- Page indexing report – Search Console Help (Blocked due to access forbidden (403))support.google.com
- Verify requests from Google crawlers and fetchers – Google Crawling Infrastructuredevelopers.google.com
- Reduce the Google crawl rate – Google Crawling Infrastructuredevelopers.google.com
Last updated: