What Is a 403 Forbidden Error? Meaning for SEO

What is a 403 Forbidden error?

A 403 Forbidden response means the server received the request, understood it, and declined to serve the content. For search engines a page that answers 403 is unavailable: it is not indexed, and a previously indexed URL that starts returning 403 is removed over time.

Intentional 403s on private areas are fine. The costly ones are those sent to crawlers by mistake.

Updated September 30, 2026By the Hydrogen SEO team

Where 403s come from

File permissions and ownership. The web server cannot read the file or directory.
Directory listing disabled. A request for a folder with no index file returns 403 on most servers. This is correct behaviour.
Deny rules in .htaccess or the server configuration, by IP, country, referrer or user agent.
Firewalls and bot protection at the host, CDN or plugin level.
Hotlink protection refusing image requests from other sites, and sometimes from image crawlers.

The crawler-only 403

The pattern that damages sites is a page that loads normally in a browser and returns 403 to Googlebot. You see nothing wrong, and Search Console lists the URL as Blocked due to access forbidden (403) in the Page indexing report.

Typical causes are bot-protection rules that challenge anything that is not a regular browser, country blocks that catch crawler IP addresses, and rate limiting set to answer with 403. A rough check from the command line:

code

$ curl -I -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" https://example.com/page/
HTTP/2 403

A 403 there with a 200 for a normal request shows a rule keyed on the user agent. A clean result does not prove everything is fine, because rules keyed on IP address only fire for real crawler traffic. The live test in the URL Inspection tool is the reliable check, since the request comes from Google.

What Google does with a 403

Google treats 4xx responses, other than 429, as "the content is not there". The page is not used for indexing, and links on it are not followed. Two consequences are worth knowing:

Do not use 403 to slow crawlers down. Google states that 401 and 403 should not be used for limiting crawl rate. Use 429 or 503 for that.
A 403 on robots.txt is not a block. Google treats most 4xx responses for robots.txt as if no file exists, meaning everything may be crawled.

Resources matter too. If CSS, JavaScript or images return 403 to Googlebot, the page may render incorrectly for it even though the HTML is reachable.

Fixing 403s on WordPress

Find the layer. Response headers and the error page's wording usually reveal whether the host, the CDN or a plugin refused the request.
Allow verified search crawlers in the firewall. Most providers have a setting for known good bots.
Check permissions: directories are normally 755 and files 644.
Review .htaccess for deny rules, especially ones pasted in from security guides.
Leave the right things forbidden. /wp-admin/ for logged-out users, xmlrpc.php if you block it, and upload folders without an index are not problems to solve.

After the fix, use Validate fix in the Page indexing report so Google rechecks the affected URLs.

Common questions

Does a 403 error affect SEO?

Yes, when it hits pages you want indexed. Google drops URLs that keep returning 403. A 403 on areas that should be private has no negative effect.

What is the difference between 401 and 403?

A 401 says authentication is required and invites the client to supply credentials. A 403 says the request is refused regardless, and trying again with the same identity will not help.

Why does Google get a 403 when my page loads fine?

A firewall, CDN or security plugin is treating the crawler differently from a browser, usually through bot protection, a country block or a rate limit. Allow verified search engine crawlers in that layer.