403 vs 401 vs 404
| Status | What the server is saying | Will signing in help? |
|---|---|---|
| 401 Unauthorized | You need to authenticate (it sends WWW-Authenticate) | Yes, with valid credentials |
| 403 Forbidden | I understood the request and won't fulfil it | No, unless your account gets more access |
| 404 Not Found | There is nothing here, or nothing I'll admit to | No |
RFC 9110 lets a server answer 404 instead of 403 when it doesn't want to reveal that a forbidden resource exists, so a 404 can hide a 403.
What causes a 403 Forbidden error
- File and folder permissions. The web server can't read the file, or a folder has no index page and directory listing is off. On sites you run yourself, this is the first thing to check.
- Access rules. The site allows only some IP addresses, networks or countries, or blocks others.
- A firewall or bot-protection rule. A web application firewall (WAF) or CDN matched the request against a rule set to block it.
- Missing permissions in an app or API. You are signed in, but your account or API key isn't allowed to do this.
- A failed CSRF check. Many web frameworks answer 403 when a form is posted without a valid CSRF token.
- Hotlink protection. Some sites refuse requests for images or files when the
Refererheader points to another site.
Did the proxy or the website send the 403?
For an https:// URL your client first asks the proxy to open a tunnel with a CONNECT request. A status sent in reply to CONNECT, before the tunnel opens, comes from the proxy, and nothing reached the site; Python requests raises a ProxyError for it instead of returning a response. Once the tunnel is open, the proxy only relays encrypted bytes, so a status that comes back as a normal response came from the site's side: its server, load balancer or CDN.
Most 403s come from the website's side. A proxy can send a 403 of its own in reply to CONNECT, for example for a destination its policy doesn't allow, but then nothing reached the site.
The headers usually name the sender: Server: cloudflare and a CF-Ray header mean Cloudflare answered, and other CDNs and firewalls add their own. Send the same request without the proxy too. If it also gets a 403, the proxy isn't the cause.
403 Forbidden on Cloudflare sites
Cloudflare sits in front of many sites and applies the rules each site owner sets. When one of those rules blocks a request, Cloudflare sends its own page with a 403 status. The page shows an error number (1020 means a firewall rule denied access) and a Ray ID, a reference for that one request.
Cloudflare's challenge pages, which ask a browser to show it is a real browser before continuing, are also sent with a 403, along with a cf-mitigated: challenge response header. A challenge means the site wants a person in a browser there, so for a script it is a no: use the site's API if it has one, or ask the owner for access.
If you are the visitor
You can't change the rule. Note the Ray ID and the time, and contact the site owner if you think the block is a mistake. If you collect data from the site, check whether it offers an API or a data feed, and read its terms.
If you run the site
Look up the Ray ID in your Cloudflare security events to see which rule matched, then change the rule if it catches visitors you want, such as your own uptime checks or partners' integrations.
How to fix a 403 error
As a visitor or API client
- Check that you are allowed to access the page: signed in with an account that has access, or using an API key with the right permissions.
- Read the response body and headers. Many 403 pages say why, and the headers show who sent it.
- If you fetch pages with a script, read the site's terms and
robots.txt. A site that blocks automated access is telling you something. - If your job checks one country's version of a site, confirm the line exits in that country with the IP checker. A site that serves only some countries may refuse requests from others.
- Don't repeat the request in a loop or rotate through IPs for a different answer. A 403 is a decision, and repeating the request won't change it.
As the site owner
- Check file and folder permissions, and that the folder has an index file.
- Check IP, country and WAF rules (including Cloudflare's) for one that matches the blocked request.
- Check the app's own permission and CSRF settings.
- Read the web server's error log at the time of the request.
Check who sent a 403: curl and Python
# Response headers only: Server, CF-Ray and similar headers name who answered
curl -sS -o /dev/null -D - -x "http://USERNAME:PASSWORD@HOST:PORT" https://example.com/page
# The same request without the proxy: a 403 here too means the proxy isn't the cause
curl -sS -o /dev/null -D - https://example.com/pageimport requests
proxy = "http://USERNAME:PASSWORD@HOST:PORT"
try:
r = requests.get("https://example.com/page", proxies={"http": proxy, "https": proxy}, timeout=30)
except requests.exceptions.ProxyError as err:
print("The proxy refused the CONNECT request:", err)
else:
print(r.status_code)
print("Server:", r.headers.get("Server"))
print("CF-Ray:", r.headers.get("CF-Ray"))
print("Challenge:", r.headers.get("cf-mitigated"))
print(r.text[:300]) # the start of the page often says why403 errors when you use proxies
A proxy changes the IP address a site sees. It doesn't change who you are or what the site allows, so a 403 through a proxy is the site refusing the request. Treat it as an answer. BuyProxy's acceptable use policy asks you to follow each site's terms, robots.txt and rate limits, and switching IPs to get a different answer from a site that has refused you goes against that.
What you can do is make sure the request is the one you meant to send: the right country on a geo-targeted line, and a session that stays on one IP while you are signed in. For logins and multi-step flows, use a sticky session. On Core Residential, sticky is on or off and usually keeps the same IP for around 10 minutes; on Premium Residential you set the length, from 3 minutes to 24 hours. A sign-in that jumps between IPs in the middle of a session can look suspicious to a site and end in a 403.
If the 403 comes from the BuyProxy API itself (www.buyproxy.org/v1), it means the key's account is suspended, or a reseller key is calling the Reseller endpoints after the account dropped below the Business plan. See API authentication.
403 Forbidden: frequently asked questions
What does 403 Forbidden mean?
The server understood the request and refuses to fulfil it. Sending it again won't help: you need different permissions, or the site has chosen not to serve this request.
Why do I get 403 Forbidden on a Cloudflare site?
A rule the site owner set in Cloudflare blocked the request, or Cloudflare served a challenge page, which is also sent with a 403. The page shows a Ray ID that the site owner can look up to see which rule matched.
Is a 403 Forbidden error my fault or the website's?
It depends. A missing permission or sign-in on your side causes some 403s; others come from the site's access rules or firewall. Read the response body and headers, and if you think the block is a mistake, contact the site with the time and any Ray ID.
Will a different proxy IP fix a 403?
No, and that isn't what proxies are for. A 403 is the site's decision about the request. Check that you are allowed to access the page, that the targeting and session match what you need, and follow the site's terms.
What is the difference between 401 and 403?
401 means the server needs valid credentials and will accept them. 403 means it understood the request and won't serve it, whatever credentials you send.