Knowledge Base

403 Forbidden Error and Solution

The 403 Forbidden error is an HTTP error that typically occurs when requests are blocked by the web server. Compared to 404 Not Found, 500 Internal Server Error, and 503 Service Unavailable errors, the cause of a 403 Forbidden error is usually easier to understand. When encountering a 403 Forbidden error, the areas that need to be checked are fixed, allowing for a quicker resolution.

What is a 403 Forbidden Error?

The translation of this error in Turkish is "Forbidden." Due to configurations within the web server, firewall software, or rules in the server configuration file of the website, if the client's request does not meet the requirements of these rules, the web server returns a 403 Forbidden error.

For example, if the IP address of a visitor to the website is on a blacklist in the firewall or server configuration, the visitor will encounter a 403 Forbidden error.

Causes of the 403 Forbidden Error:

• The visitor's IP address is blocked by a firewall software or configuration within the server or software.
• The visitor's User Agent information is blocked by a firewall software or configuration within the server or software.
• GET and POST requests are filtered by a WAF software such as Mod Security on the server.
• Incorrect chmod and chown permissions of files and directories.
• The absence of an index.php file in the directory the request is sent to.

How to Resolve the 403 Forbidden Error:

To resolve the 403 Forbidden error, you can start by removing or deactivating any rules you have added in the web server configuration and testing the changes. Check any rules you have added in your .htaccess file or nginx.conf file if you are using Nginx.

If there are no additional rules in your .htaccess file or nginx.conf file, and if there is any WAF software or Mod Security on the server, the issue might be caused by these firewall softwares.

To disable Mod Security with the .htaccess file, you can add the following commands to the beginning of your .htaccess file or disable it through your hosting control panel:

If Mod Security or WAF software is not present, verify if there is a firewall on the server in general. If your website is hosted on a shared hosting service, you can request support from your service provider.

Sometimes, problems can arise from incorrect file permissions (chmod) or ownership permissions (chown). Your files should have chmod permissions of 644, configuration files should have permissions of 640, and directories should have permissions of 755. You can check your file and ownership permissions through FTP or your hosting control panel's file manager, if supported. You may not be able to edit ownership permissions through FTP or the hosting control panel; in such cases, you can request support from your service provider for confirmation.

If you are using an old browser version, there might be a rule on the server blocking older browser versions, i.e., User Agent information. This is because harmful bot traffic is often sent using old User Agent information, which can be blocked by firewall software.

Conclusion:

In conclusion, the 403 Forbidden error occurs in situations where access is blocked.