403 Forbidden
The client does not have access rights to the content; that is, it is unauthorized, so the server is refusing to give the requested resource.
Explanation
The 403 (Forbidden) status code indicates that the server understood the request but refuses to authorize it. Unlike a 401 Unauthorized response, authenticating will make no difference - the server has determined that the client simply is not allowed to access the resource.
A 403 response is not a case of insufficient credentials; that would be 401 (Unauthorized). 403 indicates that the client may be authenticated but still doesn't have permission to access the requested resource.
This status code is commonly used when:
- A user account doesn't have the necessary permissions
- Access restrictions based on IP address or geographical location are in place
- Request rate limiting has been triggered
- The resource exists but is deliberately hidden from public view
Example Response
HTTP/1.1 403 Forbidden
Content-Type: application/json
{"error": "Forbidden", "message": "You don't have permission to access this resource"}
Related Status Codes
Check where URLs redirect to with our free URL redirect checker.
Check URL Redirects