What is a 403 Forbidden error?
A 403 is a refusal, not a failure. The server knows exactly what was asked for; it has decided that this visitor, with these credentials, from this address, is not allowed to have it. That makes it different from a 404, where nothing exists at the address, and from a 401, where the server is asking for a login it has not yet been given. A 403 says: we know who you are, and the answer is no.
Sometimes that is deliberate. Admin areas, private directories, staging sites and client review pages are supposed to return 403 to the public. Sometimes it is an accident of configuration: a file permission set wrong during a deploy, a security plugin that decided a real visitor looked like a bot, a firewall rule that blocks an entire country where your customers happen to live.
Why it matters
Why a 403 Forbidden error matters
Because a crawler takes it at its word. If Googlebot receives a 403 on a page that used to be indexed, it will try again a few times and then drop the page. If a firewall is returning 403 to crawlers sitewide, which happens more often than anyone admits, the entire site can fall out of the index while the people who run it see a perfectly healthy website in their own browsers. The visitors who matter most for search are the ones who are never shown the page.
It also damages trust. A customer who follows a campaign link and gets a blank page that says Forbidden assumes the brand has locked them out on purpose. Nobody reads the small print of a status code.
In practice
How a 403 Forbidden error works in practice
- 01
Diagnose by asking who is being refused. If everyone gets a 403 on a page that should be public, it is a permissions or configuration problem on the server, usually a .htaccess rule, a file mode or a directory without an index file. If only some visitors get it, look at the security layer: the hosting firewall, a bot-protection service, a plugin that blocks by IP or user agent. Checking the page as Googlebot in Search Console's URL Inspection tool tells you what the crawler is being served.
- 02
Prevent it with intent. Decide which areas of the site should refuse the public, return a 403 there on purpose and keep them out of the sitemap. Everything else should be reachable by anyone, including crawlers from search engines and the social platforms that build link previews, and someone should test that after every security change.
Watch out
What people get wrong about 403 Forbidden errors
Using a 403 to hide a page from search instead of a noindex. A page that returns 403 to Googlebot but 200 to visitors is a mismatch Google may read as cloaking, and in any case a 403 drops the page from the index entirely rather than quietly. The right tool for "crawl this but do not show it" is a noindex tag; the right tool for "nobody should see this" is a real 403 for everyone.
Blaming the visitor. When a customer reports a Forbidden page, the reflex is to assume their connection or device is at fault. It is almost always a rule on your side, and the customer is the first of many to hit it.
