4xx · Client errorterminal
403Forbidden
The request was valid, but the server is refusing action. The user might not have the necessary permissions for a resource.
What this code obliges you to do
Retry
Do not retry automatically
Repeating the same request produces the same result. A retry loop here just multiplies load and hides the real fault.
Caching
Not cacheable by default
Caches will not store this response unless you send explicit freshness headers saying they may.
Response body
Body allowed
You may return a payload explaining the outcome — for an error, a machine-readable problem document is worth the effort.
What usually causes it
31
Lacking IAM roles
2
IP address blocked by WAF
3
Directory listing disabled
Effect on search
Pages blocked aggressively. Search bots cannot index 403 pages.
How to send it
1Node.js (Express)
res.status(403).json({ error: 'Access Denied' });Codes people confuse with this one
2Class4xx
RetryNo
CacheNo
BodyAllowed