403 Forbidden

HTTP 403 Forbidden means the client is authenticated but does not have permission to access the resource. Unlike 401, no further authentication will help — the user simply lacks privileges.

Permission denied scenarios, IP blocks, geo-restrictions, role-based access control failures.

• User lacks the required role or permission
• IP address blocked by firewall or rate limiter
• Geo-restriction blocking the country
• CORS policy rejecting the request
• WAF blocking suspicious traffic

• Check user roles and permissions in your auth system
• Whitelist the IP if it was blocked in error
• Verify CORS headers if calling cross-origin
• Review WAF logs for false-positive blocks

HTTP/1.1 403 Forbidden
Content-Type: text/html