HTTP 403 Forbidden
Insufficient user permissions, IP blocked by security firewall (WAF), or improper Linux file permissions.
4xx Client Errors
RFC 9110 Section 15.5.4
Test endpoint:
curl -i -X GET https://httpbin.org/status/403 ⚠️ Common Causes
- • Incorrect Linux permissions (e.g. 600 instead of 644 on web files)
- • IP address or country blocked by WAF rules
🛠️ How to Fix / Developer Actions
- ✓ Audit server filesystem permissions with a Chmod calculator: 755 for dirs, 644 for files
- ✓ Verify user roles and RBAC privileges in application settings
Open the full tool: Convert cURL to Fetch, Python, or Go →
Status Reference & Causes
4xx Client Errors Status Codes Table
| Код | Название | RFC |
|---|---|---|
| 400 | Bad Request | RFC 9110 Section 15.5.1 |
| 401 | Unauthorized | RFC 9110 Section 15.5.2 |
| 403 | Forbidden | RFC 9110 Section 15.5.4 |
| 404 | Not Found | RFC 9110 Section 15.5.5 |
| 405 | Method Not Allowed | RFC 9110 Section 15.5.6 |
| 408 | Request Timeout | RFC 9110 Section 15.5.9 |
| 409 | Conflict | RFC 9110 Section 15.5.10 |
| 410 | Gone | RFC 9110 Section 15.5.11 |
| 418 | I'm a teapot | RFC 2324 / RFC 9110 Section 15.5.19 |
| 422 | Unprocessable Content | RFC 9110 Section 15.5.21 |
| 429 | Too Many Requests | RFC 6585 Section 4 |
FAQ
What does HTTP 403 Forbidden mean?
Insufficient user permissions, IP blocked by security firewall (WAF), or improper Linux file permissions. It is defined in RFC 9110 Section 15.5.4 as a 4xx Client Errors status code.
Is HTTP 403 an error on client or server side?
HTTP 403 is a client-side error (4xx), meaning the request itself was invalid, unauthorized, or malformed.
How can I test an HTTP 403 response in terminal?
You can use cURL with the -I flag to fetch headers only: curl -I https://httpbin.org/status/403