4xx Client error
403 Forbidden
The server understood who you are but refuses to allow the request.
Authentication succeeded (or isn’t required) but the client lacks permission. Re-authenticating won’t help.
Common causes and fixes
- Check the user’s role or the API key’s scopes.
- For static files, check file-system permissions and that directory listing isn’t being requested.
- A WAF, IP allow-list, hot-link protection or region block may be rejecting the request.
- For object storage (S3, OSS, COS), check the bucket policy and whether the URL signature has expired.
Example response
HTTP/1.1 403 Forbidden
Date: Thu, 22 Oct 2026 08:00:00 GMT Check a URL’s status with curl -I https://example.com, which prints the status line and headers.