403 Forbidden: why a website refuses access
A 403 Forbidden response means a server understood the request but will not allow it. It can be intentional on a private resource. On a page that should be public, the website owner needs to investigate the access rules, rather than assume that refreshing or changing a password will solve it.
Before you start
- Keep the affected address, exact error wording and the time, including your time zone.
- Decide whether this is a public customer page or something restricted to a particular account.
- Do not include private account links, access tokens or customer information in a public screenshot.
What to do
Check the route customers actually use
Open the homepage using the known business address, then follow its navigation to the affected page. Note whether the menu works but an old bookmark fails. If only an administrator page is restricted, report that separately from a public website outage.
Keep a small comparison
Check one other public page and, if appropriate, the same address on your own mobile connection. Record the results without repeatedly retrying a blocked action. A difference between connections is useful evidence for the administrator; it is not permission to evade a security restriction.
Ask for an access-rule review
Give the hosting or website administrator the exact time and any request reference displayed. Ask them to identify the rule or application decision that denied access. They can then decide whether the restriction is deliberate or a configuration error, and approve a narrowly scoped correction.
Confirm the intended audience can return
After an agreed change, check the original public route in a signed-out browser. Confirm that the relevant page loads while genuinely private areas remain protected. Keep a short record of what was changed and who approved it so the same rule is not accidentally reintroduced.
What to check
- The administrator has identified why access was denied, or clearly recorded what remains unknown.
- The intended public page works without an administrator login.
- Private pages and security controls have not been made public as a workaround.
Sources and further reading
Platform features can change. Check the provider’s current guidance before changing a live service.