PathWhen requests get blocked

Step 1 of 6

403 Forbidden Error: What It Means and How to Fix It

Pim · Scrappey Research

October 29, 2026 6 min read

Paste into ChatGPT, Claude, or any LLM

What Is a 403 Error (Forbidden)? — conceptual illustration

On this page

HTTP 403 Forbidden means the server understood your request but refuses to answer it. The difference from 401 is simple: 401 means "we don't know who you are, log in first," while 403 means "we know who you are and the answer is still no." For scrapers, 403 is the classic anti-bot block — the server decided your request looks automated and cut it off before sending the page.

Status code	403
Category	4xx Client Error
Common causes (scraping)	Bot detection, missing/wrong headers, blocked IP, geo restriction
Common causes (general)	Insufficient permissions, expired auth, IP allowlist
Typical body	"Access Denied", "Forbidden", or a Cloudflare challenge page

What a 403 Forbidden error means for visitors and site owners

A 403 is the server saying "I know what you asked for, and you can't have it." The page usually exists. Access is refused because of who is asking, where the request comes from, or how the server is configured. Logging in again often doesn't help, which is what separates it from a 401.

If you're visiting a site:

Check the URL. A link to a folder instead of a page (ending in /) returns 403 on many servers when directory listing is turned off.
Reload, then clear the site's cookies and cache. A stale session cookie can keep you locked out.
Turn off your VPN or proxy and try again. Many sites refuse whole IP ranges that belong to VPNs, data centers, or other countries.
Log in if the page belongs to an account, and check that your account has access to it.
If nothing works, the block is on the site's side. Contact the site owner and mention the time and the URL.

If you run the site:

Check file and folder permissions. On Linux web servers, files usually need 644 and folders 755, readable by the web server user.
Make sure the folder has an index file (index.html or index.php), or the server refuses to list it.
Look for deny rules in .htaccess or your Nginx config, and for IP allowlists that leave out your visitors.
Check your firewall, CDN, or WAF logs (Cloudflare, Sucuri, Wordfence). A security rule or country block is the most common cause of 403s for real visitors.

Why 403s happen in scraping

On a normal API, a 403 just means you logged in but aren't allowed to see this particular thing. In scraping it almost always means an anti-bot system spotted you. Common triggers: your IP belongs to a known datacenter range (servers, not homes), a missing or odd User-Agent (the string a browser sends to identify itself), a TLS fingerprint that doesn't match that User-Agent (TLS is the encryption layer behind https, and its handshake quietly reveals which client you really are), too many requests too fast, a geo block on your country, or a behavioral signal picked up on an earlier page. Cloudflare in particular returns 403 with its own branded challenge page as the body — if you see "Cloudflare" and a ray ID in the HTML, that's the source. The 403 is just the symptom; the real decision happened a layer above it.

How to diagnose a 403

Start by reading the response body — that's where the truth is. A short plain "Forbidden" page usually means a simple WAF rule (a web application firewall, basic pattern-matching at the edge); a Cloudflare/Akamai/DataDome branded page means a dedicated bot-detection service. Check the response headers for cf-ray, x-amzn-waf-action, server: AkamaiGHost, or x-datadome to see which vendor it is. Then check what you're sending: is the User-Agent realistic? Is Accept-Language present? Does your TLS fingerprint match the browser you claim to be? Finally, try the same URL through a residential proxy in the target's main country — if that works, the block was based on your IP; if it still fails, the block is based on your fingerprint.

How to recover from a 403

The fix depends on the cause. IP-based 403s clear by rotating through residential or mobile proxy addresses. Header-based 403s clear with realistic headers — copy a real browser's headers from DevTools exactly. Fingerprint-based 403s need a real browser stack: Playwright driving a real browser engine, or a managed scraping API that maintains a consistent browser configuration. A 403 that redirects to a CAPTCHA needs a solver. A geo-based 403 needs a proxy in the right country. One rule above all: never retry a 403 without changing something — repeat 403s from the same identity only make the block stronger.

Fixing a 403 in Python requests

Work through four layers in order — most 403s are solved by the first two:

Send a realistic User-Agent. The default python-requests/2.x string is the single most common cause of a 403 that works fine in a browser.
Send the full browser header set — Accept, Accept-Language, Accept-Encoding, and Referer. A request with only a User-Agent still looks nothing like a real browser.
Persist cookies with a requests.Session(). Many sites set a cookie on first load and 403 any request that arrives without it.
If 403s survive all of the above, the site is fingerprinting your TLS/HTTP2 handshake (typical of Cloudflare and DataDome). Plain requests can't change that — switch to curl_cffi with impersonate="chrome", a headless browser, or a managed scraping API.

The code example below shows the headers-plus-session approach and the curl_cffi fallback side by side.

Code example

python

import requests

# Layer 1+2+3: realistic headers + a session that persists cookies.
BROWSER_HEADERS = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
                  "AppleWebKit/537.36 (KHTML, like Gecko) "
                  "Chrome/124.0 Safari/537.36",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
    "Accept-Language": "en-US,en;q=0.9",
    "Accept-Encoding": "gzip, deflate, br",
    "Referer": "https://www.google.com/",
}

session = requests.Session()
session.headers.update(BROWSER_HEADERS)
resp = session.get("https://example.com", timeout=30)
print(resp.status_code)   # often 200 once headers + cookies look real

# Layer 4: still 403? The site is fingerprinting your TLS handshake.
# curl_cffi impersonates a real browser's TLS/JA3, which requests can't do.
#   pip install curl_cffi
from curl_cffi import requests as cffi
resp = cffi.get("https://example.com", impersonate="chrome", timeout=30)
print(resp.status_code)

Next in When requests get blocked · 2 of 6

The other code you will see constantly, and it means something different.

What Is the 429 Status Code (429 Error)?

HTTP 429 Too Many Requests is the status code a server returns when a client has sent more requests in a given window than the server's rate…

What Is the 503 Status Code (503 Service Unavailable Error)?

HTTP 503 Service Unavailable means the server can't handle your request right now — usually because it's overloaded, under maintenance, or d…

What Is Anti-Bot Detection?

Anti-bot detection is the set of techniques websites use to tell automated traffic apart from real human visitors — and then block, challeng…

What Is Browser Fingerprinting?

Browser fingerprinting is a technique that identifies and tracks a visitor by combining dozens of small, observable characteristics of their…

What Is a 200 Status Code?

HTTP 200 OK is the standard "success" status code: the server got your request, handled it, and sent back the response you expected. For a G…

What Is a 402 Error?

HTTP 402 Payment Required is the status code a server sends to say: "I won't do this until a payment, billing, or quota problem is fixed." I…

Concept map

How 403 Status Code (403 Forbidden Error) connects

The terms most directly tied to this one. Hover a node to see its neighbours, click to preview, drag to rearrange.

0 terms · 0 connections

You are here · HTTP Errors

Tools & solutions for this topic

Frequently asked questions

How do I fix a 403 Forbidden error?

As a visitor: check the URL, clear the site's cookies, and try without a VPN or proxy. If it still fails, the site is refusing your request on purpose and only the owner can change that. As a site owner: check file permissions (644 for files, 755 for folders), the index file, deny rules in .htaccess or Nginx, and your firewall or CDN security rules.

What's the difference between 401 and 403?

401 Unauthorized means you haven't proven who you are yet — log in and try again. 403 Forbidden means you're already authenticated (or no login is needed) but still aren't allowed in. For scraping without a login, 403 is the one you'll actually run into.

Does a 403 mean my IP is banned?

Sometimes. The quickest test is to send the exact same request through a different IP. If the second attempt works, the first IP is on a block list. If it still fails, the block is based on something other than your IP — usually your fingerprint or headers.

Can changing User-Agent fix a 403?

It can satisfy the most basic rules but not modern detection. Real systems cross-check the User-Agent against your TLS fingerprint, the order of your headers, signals collected by JavaScript, and your behavior. Swapping the UA alone matters little; making the UA line up consistently with everything else is what counts.

Is a 403 the same as a Cloudflare block?

Cloudflare blocks usually do return 403 with their challenge page in the body, but plenty of other sources return 403 too. Read the response body and headers to identify which vendor (Cloudflare, Akamai, DataDome, PerimeterX) is doing the blocking.

How do I fix a 403 Forbidden error in Python requests?

Set a real browser User-Agent and the full header set (Accept, Accept-Language, Referer), and use a requests.Session() so cookies persist. If you still get 403, the site is fingerprinting your TLS handshake — switch to curl_cffi with impersonate="chrome", a headless browser, or a scraping API that emulates a real browser.

Last updated: 2026-10-29