Access denied error number - Исправление ошибок и поиск оптимальных решений проблем

Содержание

The HTTP status code in IIS 7.0 and later versions
Introduction
Log file locations
The HTTP status codes
1xx — Informational
2xx — Success
3xx — Redirection
4xx — Client error
5xx — Server error
Common HTTP status codes and the causes
HTTP substatus codes added in IIS 8.0
HTTP substatus codes added in ARR 3.0.1916
References

The HTTP status code in IIS 7.0 and later versions

This article provides a list of the Hypertext Transfer Protocol (HTTP) status codes in Microsoft Internet Information Services (IIS) 7.0 and later versions.

Original product version: В Internet Information Services 7.0 and later versions
Original KB number: В 943891

Introduction

When you try to access content on a server that is running (IIS) 7.0, 7.5 or later versions by using the HTTP protocol, IIS returns a numeric code that indicates the status of the response. The HTTP status code is recorded in the IIS log. Additionally, the HTTP status code may be displayed in the client browser.

The HTTP status code may indicate whether a request is successful or unsuccessful. The HTTP status code may also reveal the exact reason that a request is unsuccessful.

Log file locations

IIS 7.0 and later versions put log files in the following folder by default:
inetpublogsLogfiles

This folder contains separate directories for each World Wide Web website. The log files are created in the directories daily and are named by using the date by default. For example, a log file may be named as exYYMMDD.log.

The HTTP status codes

This section describes the HTTP status codes that IIS 7.0 and later versions use.

This article doesn’t list every possible HTTP status code as dictated in the HTTP specification. This article includes only the HTTP status codes that IIS 7.0 and later versions can send. For example, a custom Internet Server API (ISAPI) filter or a custom HTTP module can set its own HTTP status code.

1xx — Informational

These HTTP status codes indicate a provisional response. The client computer receives one or more 1xx responses before the client computer receives a regular response.

IIS 7.0 and later versions use the following informational HTTP status codes:

100 — Continue.
101 — Switching protocols.

2xx — Success

These HTTP status codes indicate that the server successfully accepted the request.

IIS 7.0 and later versions use the following success HTTP status codes:

200 — OK. The client request has succeeded.
201 — Created.
202 — Accepted.
203 — Nonauthoritative information.
204 — No content.
205 — Reset content.
206 — Partial content.

3xx — Redirection

These HTTP status codes indicate that the client browser must take more action to fulfill the request. For example, the client browser may have to request a different page on the server. Or, the client browser may have to repeat the request by using a proxy server.

IIS 7.0 and later versions use the following redirection HTTP status codes:

301 — Moved permanently.
302 — Object moved.
304 — Not modified.
307 — Temporary redirect.

4xx — Client error

These HTTP status codes indicate that an error has occurred and the client browser appears to be at fault. For example, the client browser may have requested a page that doesn’t exist. Or, the client browser may not have provided valid authentication information.

IIS 7.0 and later versions use the following client error HTTP status codes:

400 — Bad request. The request could not be understood by the server due to malformed syntax. The client should not repeat the request without modifications.

IIS 7.0 and later versions define the following HTTP status codes that indicate a more specific cause of an error 400:

400.1 — Invalid Destination Header.
400.2 — Invalid Depth Header.
400.3 — Invalid If Header.
400.4 — Invalid Overwrite Header.
400.5 — Invalid Translate Header.
400.6 — Invalid Request Body.
400.7 — Invalid Content Length.
400.8 — Invalid Timeout.
400.9 — Invalid Lock Token.

401 — Access denied.

IIS 7.0 and later versions define several HTTP status codes that indicate a more specific cause of an error 401. The following specific HTTP status codes are displayed in the client browser but aren’t displayed in the IIS log:

401.1 — Logon failed.
401.2 — Logon failed due to server configuration.
401.3 — Unauthorized due to ACL on resource.
401.4 — Authorization failed by filter.
401.5 — Authorization failed by ISAPI/CGI application.
401.501 — Access Denied: Too many requests from the same client IP; Dynamic IP Restriction Concurrent request rate limit reached.
401.502 — Forbidden: Too many requests from the same client IP; Dynamic IP Restriction Maximum request rate limit reached.
401.503 — Access Denied: the IP address is included in the Deny list of IP Restriction
401.504 — Access Denied: the host name is included in the Deny list of IP Restriction

IIS 7.0 and later versions define the following HTTP status codes that indicate a more specific cause of an error 403:

403.1 — Execute access forbidden.
403.2 — Read access forbidden.
403.3 — Write access forbidden.
403.4 — SSL required.
403.5 — SSL 128 required.
403.6 — IP address rejected.
403.7 — Client certificate required.
403.8 — Site access denied.
403.9 — Forbidden: Too many clients are trying to connect to the web server.
403.10 — Forbidden: web server is configured to deny Execute access.
403.11 — Forbidden: Password has been changed.
403.12 — Mapper denied access.
403.13 — Client certificate revoked.
403.14 — Directory listing denied.
403.15 — Forbidden: Client access licenses have exceeded limits on the web server.
403.16 — Client certificate is untrusted or invalid.
403.17 — Client certificate has expired or is not yet valid.
403.18 — Cannot execute requested URL in the current application pool.
403.19 — Cannot execute CGI applications for the client in this application pool.
403.20 — Forbidden: Passport logon failed.
403.21 — Forbidden: Source access denied.
403.22 — Forbidden: Infinite depth is denied.
403.501 — Forbidden: Too many requests from the same client IP; Dynamic IP Restriction Concurrent request rate limit reached.
403.502 — Forbidden: Too many requests from the same client IP; Dynamic IP Restriction Maximum request rate limit reached.
403.503 — Forbidden: the IP address is included in the Deny list of IP Restriction
403.504 — Forbidden: the host name is included in the Deny list of IP Restriction

IIS 7.0 and later versions define the following HTTP status codes that indicate a more specific cause of an error 404:

404.0 — Not found.
404.1 — Site Not Found.
404.2 — ISAPI or CGI restriction.
404.3 — Multipurpose Internet Mail Extensions (MIME) type restriction.
404.4 — No handler configured.
404.5 — Denied by request filtering configuration.
404.6 — Verb denied.
404.7 — File extension denied.
404.8 — Hidden namespace.
404.9 — File attribute hidden.
404.10 — Request header too long.
404.11 — Request contains double escape sequence.
404.12 — Request contains high-bit characters.
404.13 — Content length too large.
404.14 — Request URL too long.
404.15 — Query string too long.
404.16 — DAV request sent to the static file handler.
404.17 — Dynamic content mapped to the static file handler via a wildcard MIME mapping.
404.18 — Querystring sequence denied.
404.19 — Denied by filtering rule.
404.20 — Too Many URL Segments
404.501 — Not Found: Too many requests from the same client IP; Dynamic IP Restriction Concurrent request rate limit reached.
404.502 — Not Found: Too many requests from the same client IP; Dynamic IP Restriction Maximum request rate limit reached.
404.503 — Not Found: the IP address is included in the Deny list of IP Restriction
404.504 — Not Found: the host name is included in the Deny list of IP Restriction

405 — Method Not Allowed.

406 — Client browser does not accept the MIME type of the requested page.

408 — Request timed out.

412 — Precondition failed.

5xx — Server error

These HTTP status codes indicate that the server can’t complete the request because the server encounters an error.

IIS and later versions use the following server error HTTP status codes:

500 — Internal server error.

IIS 7.0 and later versions define the following HTTP status codes that indicate a more specific cause of an error 500:

500.0 — Module or ISAPI error occurred.

500.11 — Application is shutting down on the web server.

500.12 — Application is busy restarting on the web server.

500.13 — Web server is too busy.

500.15 — Direct requests for Global.asax are not allowed.

500.19 — Configuration data is invalid.

500.21 — Module not recognized.

500.22 — An ASP.NET httpModules configuration does not apply in Managed Pipeline mode.

500.23 — An ASP.NET httpHandlers configuration does not apply in Managed Pipeline mode.

500.24 — An ASP.NET impersonation configuration does not apply in Managed Pipeline mode.

500.50 — A rewrite error occurred during RQ_BEGIN_REQUEST notification handling. A configuration or inbound rule execution error occurred.

Here is where the distributed rules configuration is read for both inbound and outbound rules.

500.51 — A rewrite error occurred during GL_PRE_BEGIN_REQUEST notification handling. A global configuration or global rule execution error occurred.

Here is where the global rules configuration is read.

500.52 — A rewrite error occurred during RQ_SEND_RESPONSE notification handling. An outbound rule execution occurred.

500.53 — A rewrite error occurred during RQ_RELEASE_REQUEST_STATE notification handling. An outbound rule execution error occurred. The rule is configured to be executed before the output user cache gets updated.

500.100 — Internal ASP error.

501 — Header values specify a configuration that is not implemented.

502 — Web server received an invalid response while acting as a gateway or proxy.

IIS 7.0 and later versions define the following HTTP status codes that indicate a more specific cause of an error 502:

502.1 — CGI application timeout.
502.2 — Bad gateway: Premature Exit.
502.3 — Bad Gateway: Forwarder Connection Error (ARR).
502.4 — Bad Gateway: No Server (ARR).

503 — Service unavailable.

IIS 7.0 and later versions define the following HTTP status codes that indicate a more specific cause of an error 503:

503.0 — Application pool unavailable.
503.2 — Concurrent request limit exceeded.
503.3 — ASP.NET queue full
503.4 — FastCGI queue full

Common HTTP status codes and the causes

The following table describes the causes of some common HTTP status codes.

Code	Description	Notes
200	OK	IIS 7.0 and later versions successfully processed the request.
304	Not modified	The client browser requests a document that is already in the cache. And the document hasn’t been modified since it was cached. The client browser uses the cached copy of the document instead of downloading the document from the server.
400	Bad request	The Hypertext Transfer Protocol Stack (Http.sys) file blocks IIS 7.0 and later versions from processing the request because of a problem in the request. Typically, this HTTP status code means that the request contains invalid characters or sequences, or that the request goes against the security settings in the Http.sys file.
401.1	Logon failed	The logon attempt is unsuccessful probably because of a user name or a password that is invalid.
401.2	Logon failed due to server configuration	This HTTP status code indicates a problem in the authentication configuration settings on the server.
401.3	Unauthorized due to ACL on resource	This HTTP status code indicates a problem in the NTFS file system permissions. This problem may occur even if the permissions are correct for the file that you try to access. For example, this problem occurs if the IUSR account doesn’t have access to the C:WinntSystem32Inetsrv directory.
401.4	Authorization failed by filter	An Internet Server Application Programming Interface (ISAPI) filter doesn’t let the request be processed because of an authorization problem.
401.5	Authorization failed by ISAPI/CGI application	An ISAPI application or a Common Gateway Interface (CGI) application doesn’t let the request be processed because of an authorization problem.
403.1	Execute access forbidden	The appropriate level of the Execute permission isn’t granted.
403.2	Read access forbidden	The appropriate level of the Read permission isn’t granted. Verify that you have set up IIS 7.0 and later versions to grant the Read permission to the directory. Additionally, if you use a default document, verify that the default document exists.
403.3	Write access forbidden	The appropriate level of the Write permission isn’t granted. Check the IIS 7.0 and later versions permissions and the NTFS file system permissions. Make sure that they are set up to grant the Write permission to the directory.
403.4	SSL required	The request is made over a non-secure channel. But the web application requires a Secure Sockets Layer (SSL) connection.
403.5	SSL 128 required	The server is configured to require a 128-bit SSL connection. But, the request isn’t sent by using 128-bit encryption.
403.6	IP address rejected	The server is configured to deny access to the current IP address.
403.7	Client certificate required	The server is configured to require a certificate for client authentication. But the client browser doesn’t have an appropriate client certificate installed. For more information, see HTTP error 403.7 when you run a web application that’s hosted on a server that is running IIS 7.0.
403.8	Site access denied	The server is configured to deny requests based on the Domain Name System (DNS) name of the client computer. For more information, see Dynamic IP Address restrictions.
403.12	Mapper denied access	The page that you want to access requires a client certificate. But, the user ID that is mapped to the client certificate is denied access to the file.
403.13	Client certificate revoked	The client browser tries to use a client certificate that was revoked by the issuing certification authority.
403.14	Directory listing denied	The server isn’t configured to display a content directory listing, and a default document isn’t set. For more information, see HTTP Error 403.14 — Forbidden when you open an IIS Webpage.
403.16	Client certificate is untrusted or invalid.	The client browser tries to use an invalid client certificate. Or the server that is running IIS 7.0 and later versions doesn’t trust the client certificate. For more information, see HTTP Error 403.16 when you try to access a website that’s hosted on IIS 7.0.
403.17	Client certificate has expired or is not yet valid.	The client browser tries to use a client certificate that is expired or that isn’t yet valid.
403.18	Cannot execute requested URL in the current application pool.	A custom error page is configured. And the application pool of the customer error page is different with the application pool of the requested URL.
403.19	Cannot execute CGI applications for the client browser in this application pool.	The identity of the application pool doesn’t have the Replace a process level token user right.
404.0	Not found.	The file that you try to access is moved or doesn’t exist.
404.2	ISAPI or CGI restriction.	The requested ISAPI resource or the requested CGI resource is restricted on the computer. For more information, see HTTP Error 404.2 when you visit a web page that is hosted on a computer that is running IIS 7.0.
404.3	MIME type restriction.	The current MIME mapping for the requested extension type is invalid or isn’t configured.
404.4	No handler configured.	The file name extension of the requested URL doesn’t have a handler that is configured to process the request on the Web server.
404.5	Denied by request filtering configuration.	The requested URL contains a character sequence that is blocked by the server.
404.6	Verb denied.	The request is made by using an HTTP verb that isn’t configured or that isn’t valid.
404.7	File extension denied.	The requested file name extension isn’t allowed.
404.8	Hidden namespace.	The requested URL is denied because the directory is hidden.
404.9	Files attribute hidden.	The requested file is hidden.
404.10	Request header too long.	The request is denied because the request headers are too long.
404.11	Request contains double escape sequence.	The request contains a double escape sequence.
404.12	Request contains high-bit characters.	The request contains high-bit characters, and the server is configured not to allow high-bit characters.
404.13	Content length too large.	The request contains a Content-Length header. The value of the Content-Length header is larger than the limit that is allowed for the server. For more information, see HTTP Error 404.13 — CONTENT_LENGTH_TOO_LARGE when you visit a web site that is hosted on a server that is running IIS 7.0.
404.14	Request URL too long.	The requested URL exceeds the limit that is allowed for the server.
404.15	Query string too long.	The request contains a query string that is longer than the limit that is allowed for the server.
404.17	Dynamic content mapped to the static file handler.	For more information, see Error message when you visit a Web site that is hosted on IIS 7.0: HTTP Error 404.17 — Not Found.
405.0	Method not allowed.	The request is made by using an HTTP method that isn’t valid. For more information, see HTTP Error 405.0 when you visit a website that is hosted on a server that is running IIS.
406.0	Invalid MIME type.	The request is made by using an Accept header that contains a MIME value that isn’t valid.
412.0	Precondition failed.	The request is made by using an If-Match request header that contains a value that isn’t valid.
500	Internal server error.	This HTTP status code may occur for many server-side reasons. For more information, see HTTP Error 500.0 — Internal Server Error error when you you open an IIS 7.0 Webpage.
500.11	Application is shutting down on the web server.	The request isn’t processed because the destination application pool is shutting down. Wait for the worker process to finish shutting down, and then try the request again. If this problem persists, the web application may be experiencing problems that prevent the web application from shutting down correctly.
500.12	Application is busy restarting on the web server.	The request isn’t processed because the destination application pool is restarting. This HTTP status code should disappear when you refresh the page. If this HTTP status code appears again after you refresh the page, the problem may be caused by antivirus software that is scanning the Global.asa file. If this problem persists, the web application may be experiencing problems that prevent the web application from restarting correctly.
500.13	Web server is too busy.	The request isn’t processed because the server is too busy to accept any new incoming requests. Typically, this HTTP status code means that the number of incoming concurrent requests exceeds the number that the IIS 7.0 and later versions web application can process. This problem may occur when the performance configuration settings are set too low, the hardware is insufficient, or a bottleneck occurs in the IIS 7.0 and later versions web application. A common troubleshooting method is to generate a memory dump file of the IIS 7.0 and later versions processes when the error is occurring and then to debug the memory dump file.
500.15	Direct requests for Global.asax aren’t allowed.	A direct request for the Global.asa file or for the Global.asax file is made.
500.19	Configuration data is invalid.	This HTTP status code occurs because of a problem in the associated applicationhost.config file or in the associated Web.config file. For more information, see HTTP Error 500.19 when you open an IIS Webpage.
500.100	Internal ASP error.	An error occurs during the processing of an Active Server Pages (ASP) page. To obtain more specific information about the error, disable friendly HTTP error messages in the web browser. Additionally, the IIS log may show an ASP error number that corresponds to the error that occurs.
503.0	Service unavailable.	The request is sent to an application pool that is currently stopped or disabled. To resolve this issue, make sure that the destination application pool is started. The event log may give information about why the application pool is stopped or disabled.
503.2	Concurrent request limit exceeded.	The appConcurrentRequestLimit property is set to a value that is lower than the current number of concurrent requests. IIS 7.0 and later versions don’t allow more concurrent requests than the value of the appConcurrentRequestLimit property.

HTTP substatus codes added in IIS 8.0

Subcode	Description
400.10	Invalid X-Forwarded-For (XFF) header
400.11	Invalid WebSocket request

HTTP substatus codes added in ARR 3.0.1916

Subcode	Description
400.601	Bad client request (ARR)
400.602	Invalid time format (ARR)
400.603	Parse range error (ARR)
400.604	Client gone (ARR)
400.605	Maximum number of forwards (ARR)
400.606	Asynchronous competition error (ARR)
502.2	Map request failure (ARR)
502.3	WinHTTP asynchronous completion failure (ARR)
502.4	No server (ARR)
502.5	WebSocket failure (ARR)
502.6	Forwarded request failure (ARR)
502.7	Execute request failure (ARR)

References

For more information about HTTP status code definitions, see HTTP/1.1: Status Code Definitions.

Third-party information disclaimer

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

Источник

From Wikipedia, the free encyclopedia

This is a list of Hypertext Transfer Protocol (HTTP) response status codes. Status codes are issued by a server in response to a client’s request made to the server. It includes codes from IETF Request for Comments (RFCs), other specifications, and some additional codes used in some common applications of the HTTP. The first digit of the status code specifies one of five standard classes of responses. The optional message phrases shown are typical, but any human-readable alternative may be provided, or none at all.

Unless otherwise stated, the status code is part of the HTTP standard (RFC 9110).

The Internet Assigned Numbers Authority (IANA) maintains the official registry of HTTP status codes.^[1]

All HTTP response status codes are separated into five classes or categories. The first digit of the status code defines the class of response, while the last two digits do not have any classifying or categorization role. There are five classes defined by the standard:

1xx informational response – the request was received, continuing process
2xx successful – the request was successfully received, understood, and accepted
3xx redirection – further action needs to be taken in order to complete the request
4xx client error – the request contains bad syntax or cannot be fulfilled
5xx server error – the server failed to fulfil an apparently valid request

1xx informational response

An informational response indicates that the request was received and understood. It is issued on a provisional basis while request processing continues. It alerts the client to wait for a final response. The message consists only of the status line and optional header fields, and is terminated by an empty line. As the HTTP/1.0 standard did not define any 1xx status codes, servers must not^{[note 1]} send a 1xx response to an HTTP/1.0 compliant client except under experimental conditions.

100 Continue: The server has received the request headers and the client should proceed to send the request body (in the case of a request for which a body needs to be sent; for example, a POST request). Sending a large request body to a server after a request has been rejected for inappropriate headers would be inefficient. To have a server check the request’s headers, a client must send Expect: 100-continue as a header in its initial request and receive a 100 Continue status code in response before sending the body. If the client receives an error code such as 403 (Forbidden) or 405 (Method Not Allowed) then it should not send the request’s body. The response 417 Expectation Failed indicates that the request should be repeated without the Expect header as it indicates that the server does not support expectations (this is the case, for example, of HTTP/1.0 servers).^[2]
101 Switching Protocols: The requester has asked the server to switch protocols and the server has agreed to do so.
102 Processing (WebDAV; RFC 2518): A WebDAV request may contain many sub-requests involving file operations, requiring a long time to complete the request. This code indicates that the server has received and is processing the request, but no response is available yet.^[3] This prevents the client from timing out and assuming the request was lost.
103 Early Hints (RFC 8297): Used to return some response headers before final HTTP message.^[4]

2xx success

This class of status codes indicates the action requested by the client was received, understood, and accepted.^[1]

200 OK: Standard response for successful HTTP requests. The actual response will depend on the request method used. In a GET request, the response will contain an entity corresponding to the requested resource. In a POST request, the response will contain an entity describing or containing the result of the action.
201 Created: The request has been fulfilled, resulting in the creation of a new resource.^[5]
202 Accepted: The request has been accepted for processing, but the processing has not been completed. The request might or might not be eventually acted upon, and may be disallowed when processing occurs.
203 Non-Authoritative Information (since HTTP/1.1): The server is a transforming proxy (e.g. a Web accelerator) that received a 200 OK from its origin, but is returning a modified version of the origin’s response.^[6]^[7]
204 No Content: The server successfully processed the request, and is not returning any content.
205 Reset Content: The server successfully processed the request, asks that the requester reset its document view, and is not returning any content.
206 Partial Content: The server is delivering only part of the resource (byte serving) due to a range header sent by the client. The range header is used by HTTP clients to enable resuming of interrupted downloads, or split a download into multiple simultaneous streams.
207 Multi-Status (WebDAV; RFC 4918): The message body that follows is by default an XML message and can contain a number of separate response codes, depending on how many sub-requests were made.^[8]
208 Already Reported (WebDAV; RFC 5842): The members of a DAV binding have already been enumerated in a preceding part of the (multistatus) response, and are not being included again.
226 IM Used (RFC 3229): The server has fulfilled a request for the resource, and the response is a representation of the result of one or more instance-manipulations applied to the current instance.^[9]

3xx redirection

This class of status code indicates the client must take additional action to complete the request. Many of these status codes are used in URL redirection.^[1]

A user agent may carry out the additional action with no user interaction only if the method used in the second request is GET or HEAD. A user agent may automatically redirect a request. A user agent should detect and intervene to prevent cyclical redirects.^[10]

300 Multiple Choices: Indicates multiple options for the resource from which the client may choose (via agent-driven content negotiation). For example, this code could be used to present multiple video format options, to list files with different filename extensions, or to suggest word-sense disambiguation.
301 Moved Permanently: This and all future requests should be directed to the given URI.
302 Found (Previously «Moved temporarily»): Tells the client to look at (browse to) another URL. The HTTP/1.0 specification (RFC 1945) required the client to perform a temporary redirect with the same method (the original describing phrase was «Moved Temporarily»),^[11] but popular browsers implemented 302 redirects by changing the method to GET. Therefore, HTTP/1.1 added status codes 303 and 307 to distinguish between the two behaviours.^[10]
303 See Other (since HTTP/1.1): The response to the request can be found under another URI using the GET method. When received in response to a POST (or PUT/DELETE), the client should presume that the server has received the data and should issue a new GET request to the given URI.
304 Not Modified: Indicates that the resource has not been modified since the version specified by the request headers If-Modified-Since or If-None-Match. In such case, there is no need to retransmit the resource since the client still has a previously-downloaded copy.
305 Use Proxy (since HTTP/1.1): The requested resource is available only through a proxy, the address for which is provided in the response. For security reasons, many HTTP clients (such as Mozilla Firefox and Internet Explorer) do not obey this status code.
306 Switch Proxy: No longer used. Originally meant «Subsequent requests should use the specified proxy.»
307 Temporary Redirect (since HTTP/1.1): In this case, the request should be repeated with another URI; however, future requests should still use the original URI. In contrast to how 302 was historically implemented, the request method is not allowed to be changed when reissuing the original request. For example, a POST request should be repeated using another POST request.
308 Permanent Redirect: This and all future requests should be directed to the given URI. 308 parallel the behaviour of 301, but does not allow the HTTP method to change. So, for example, submitting a form to a permanently redirected resource may continue smoothly.

4xx client errors

This class of status code is intended for situations in which the error seems to have been caused by the client. Except when responding to a HEAD request, the server should include an entity containing an explanation of the error situation, and whether it is a temporary or permanent condition. These status codes are applicable to any request method. User agents should display any included entity to the user.

400 Bad Request: The server cannot or will not process the request due to an apparent client error (e.g., malformed request syntax, size too large, invalid request message framing, or deceptive request routing).
401 Unauthorized: Similar to 403 Forbidden, but specifically for use when authentication is required and has failed or has not yet been provided. The response must include a WWW-Authenticate header field containing a challenge applicable to the requested resource. See Basic access authentication and Digest access authentication. 401 semantically means «unauthorised», the user does not have valid authentication credentials for the target resource.; Some sites incorrectly issue HTTP 401 when an IP address is banned from the website (usually the website domain) and that specific address is refused permission to access a website.^{[citation needed]}
402 Payment Required: Reserved for future use. The original intention was that this code might be used as part of some form of digital cash or micropayment scheme, as proposed, for example, by GNU Taler,^[13] but that has not yet happened, and this code is not widely used. Google Developers API uses this status if a particular developer has exceeded the daily limit on requests.^[14] Sipgate uses this code if an account does not have sufficient funds to start a call.^[15] Shopify uses this code when the store has not paid their fees and is temporarily disabled.^[16] Stripe uses this code for failed payments where parameters were correct, for example blocked fraudulent payments.^[17]
403 Forbidden: The request contained valid data and was understood by the server, but the server is refusing action. This may be due to the user not having the necessary permissions for a resource or needing an account of some sort, or attempting a prohibited action (e.g. creating a duplicate record where only one is allowed). This code is also typically used if the request provided authentication by answering the WWW-Authenticate header field challenge, but the server did not accept that authentication. The request should not be repeated.
404 Not Found: The requested resource could not be found but may be available in the future. Subsequent requests by the client are permissible.
405 Method Not Allowed: A request method is not supported for the requested resource; for example, a GET request on a form that requires data to be presented via POST, or a PUT request on a read-only resource.
406 Not Acceptable: The requested resource is capable of generating only content not acceptable according to the Accept headers sent in the request. See Content negotiation.
407 Proxy Authentication Required: The client must first authenticate itself with the proxy.
408 Request Timeout: The server timed out waiting for the request. According to HTTP specifications: «The client did not produce a request within the time that the server was prepared to wait. The client MAY repeat the request without modifications at any later time.»
409 Conflict: Indicates that the request could not be processed because of conflict in the current state of the resource, such as an edit conflict between multiple simultaneous updates.
410 Gone: Indicates that the resource requested was previously in use but is no longer available and will not be available again. This should be used when a resource has been intentionally removed and the resource should be purged. Upon receiving a 410 status code, the client should not request the resource in the future. Clients such as search engines should remove the resource from their indices. Most use cases do not require clients and search engines to purge the resource, and a «404 Not Found» may be used instead.
411 Length Required: The request did not specify the length of its content, which is required by the requested resource.
412 Precondition Failed: The server does not meet one of the preconditions that the requester put on the request header fields.
413 Payload Too Large: The request is larger than the server is willing or able to process. Previously called «Request Entity Too Large» in RFC 2616.^[18]
414 URI Too Long: The URI provided was too long for the server to process. Often the result of too much data being encoded as a query-string of a GET request, in which case it should be converted to a POST request. Called «Request-URI Too Long» previously in RFC 2616.^[19]
415 Unsupported Media Type: The request entity has a media type which the server or resource does not support. For example, the client uploads an image as image/svg+xml, but the server requires that images use a different format.
416 Range Not Satisfiable: The client has asked for a portion of the file (byte serving), but the server cannot supply that portion. For example, if the client asked for a part of the file that lies beyond the end of the file. Called «Requested Range Not Satisfiable» previously RFC 2616.^[20]
417 Expectation Failed: The server cannot meet the requirements of the Expect request-header field.^[21]
418 I’m a teapot (RFC 2324, RFC 7168): This code was defined in 1998 as one of the traditional IETF April Fools’ jokes, in RFC 2324, Hyper Text Coffee Pot Control Protocol, and is not expected to be implemented by actual HTTP servers. The RFC specifies this code should be returned by teapots requested to brew coffee.^[22] This HTTP status is used as an Easter egg in some websites, such as Google.com’s «I’m a teapot» easter egg.^[23]^[24]^[25] Sometimes, this status code is also used as a response to a blocked request, instead of the more appropriate 403 Forbidden.^[26]^[27]
421 Misdirected Request: The request was directed at a server that is not able to produce a response (for example because of connection reuse).
422 Unprocessable Entity: The request was well-formed but was unable to be followed due to semantic errors.^[8]
423 Locked (WebDAV; RFC 4918): The resource that is being accessed is locked.^[8]
424 Failed Dependency (WebDAV; RFC 4918): The request failed because it depended on another request and that request failed (e.g., a PROPPATCH).^[8]
425 Too Early (RFC 8470): Indicates that the server is unwilling to risk processing a request that might be replayed.
426 Upgrade Required: The client should switch to a different protocol such as TLS/1.3, given in the Upgrade header field.
428 Precondition Required (RFC 6585): The origin server requires the request to be conditional. Intended to prevent the ‘lost update’ problem, where a client GETs a resource’s state, modifies it, and PUTs it back to the server, when meanwhile a third party has modified the state on the server, leading to a conflict.^[28]
429 Too Many Requests (RFC 6585): The user has sent too many requests in a given amount of time. Intended for use with rate-limiting schemes.^[28]
431 Request Header Fields Too Large (RFC 6585): The server is unwilling to process the request because either an individual header field, or all the header fields collectively, are too large.^[28]
451 Unavailable For Legal Reasons (RFC 7725): A server operator has received a legal demand to deny access to a resource or to a set of resources that includes the requested resource.^[29] The code 451 was chosen as a reference to the novel Fahrenheit 451 (see the Acknowledgements in the RFC).

5xx server errors

The server failed to fulfil a request.

Response status codes beginning with the digit «5» indicate cases in which the server is aware that it has encountered an error or is otherwise incapable of performing the request. Except when responding to a HEAD request, the server should include an entity containing an explanation of the error situation, and indicate whether it is a temporary or permanent condition. Likewise, user agents should display any included entity to the user. These response codes are applicable to any request method.

500 Internal Server Error: A generic error message, given when an unexpected condition was encountered and no more specific message is suitable.
501 Not Implemented: The server either does not recognize the request method, or it lacks the ability to fulfil the request. Usually this implies future availability (e.g., a new feature of a web-service API).
502 Bad Gateway: The server was acting as a gateway or proxy and received an invalid response from the upstream server.
503 Service Unavailable: The server cannot handle the request (because it is overloaded or down for maintenance). Generally, this is a temporary state.^[30]
504 Gateway Timeout: The server was acting as a gateway or proxy and did not receive a timely response from the upstream server.
505 HTTP Version Not Supported: The server does not support the HTTP version used in the request.
506 Variant Also Negotiates (RFC 2295): Transparent content negotiation for the request results in a circular reference.^[31]
507 Insufficient Storage (WebDAV; RFC 4918): The server is unable to store the representation needed to complete the request.^[8]
508 Loop Detected (WebDAV; RFC 5842): The server detected an infinite loop while processing the request (sent instead of 208 Already Reported).
510 Not Extended (RFC 2774): Further extensions to the request are required for the server to fulfill it.^[32]
511 Network Authentication Required (RFC 6585): The client needs to authenticate to gain network access. Intended for use by intercepting proxies used to control access to the network (e.g., «captive portals» used to require agreement to Terms of Service before granting full Internet access via a Wi-Fi hotspot).^[28]

Unofficial codes

The following codes are not specified by any standard.

419 Page Expired (Laravel Framework): Used by the Laravel Framework when a CSRF Token is missing or expired.
420 Method Failure (Spring Framework): A deprecated response used by the Spring Framework when a method has failed.^[33]
420 Enhance Your Calm (Twitter): Returned by version 1 of the Twitter Search and Trends API when the client is being rate limited; versions 1.1 and later use the 429 Too Many Requests response code instead.^[34] The phrase «Enhance your calm» comes from the 1993 movie Demolition Man, and its association with this number is likely a reference to cannabis.^{[citation needed]}
430 Request Header Fields Too Large (Shopify): Used by Shopify, instead of the 429 Too Many Requests response code, when too many URLs are requested within a certain time frame.^[35]
450 Blocked by Windows Parental Controls (Microsoft): The Microsoft extension code indicated when Windows Parental Controls are turned on and are blocking access to the requested webpage.^[36]
498 Invalid Token (Esri): Returned by ArcGIS for Server. Code 498 indicates an expired or otherwise invalid token.^[37]
499 Token Required (Esri): Returned by ArcGIS for Server. Code 499 indicates that a token is required but was not submitted.^[37]
509 Bandwidth Limit Exceeded (Apache Web Server/cPanel): The server has exceeded the bandwidth specified by the server administrator; this is often used by shared hosting providers to limit the bandwidth of customers.^[38]
529 Site is overloaded: Used by Qualys in the SSLLabs server testing API to signal that the site can’t process the request.^[39]
530 Site is frozen: Used by the Pantheon Systems web platform to indicate a site that has been frozen due to inactivity.^[40]
598 (Informal convention) Network read timeout error: Used by some HTTP proxies to signal a network read timeout behind the proxy to a client in front of the proxy.^[41]
599 Network Connect Timeout Error: An error used by some HTTP proxies to signal a network connect timeout behind the proxy to a client in front of the proxy.

Internet Information Services

Microsoft’s Internet Information Services (IIS) web server expands the 4xx error space to signal errors with the client’s request.

440 Login Time-out: The client’s session has expired and must log in again.^[42]
449 Retry With: The server cannot honour the request because the user has not provided the required information.^[43]
451 Redirect: Used in Exchange ActiveSync when either a more efficient server is available or the server cannot access the users’ mailbox.^[44] The client is expected to re-run the HTTP AutoDiscover operation to find a more appropriate server.^[45]

IIS sometimes uses additional decimal sub-codes for more specific information,^[46] however these sub-codes only appear in the response payload and in documentation, not in the place of an actual HTTP status code.

nginx

The nginx web server software expands the 4xx error space to signal issues with the client’s request.^[47]^[48]

444 No Response: Used internally^[49] to instruct the server to return no information to the client and close the connection immediately.
494 Request header too large: Client sent too large request or too long header line.
495 SSL Certificate Error: An expansion of the 400 Bad Request response code, used when the client has provided an invalid client certificate.
496 SSL Certificate Required: An expansion of the 400 Bad Request response code, used when a client certificate is required but not provided.
497 HTTP Request Sent to HTTPS Port: An expansion of the 400 Bad Request response code, used when the client has made a HTTP request to a port listening for HTTPS requests.
499 Client Closed Request: Used when the client has closed the request before the server could send a response.

Cloudflare

Cloudflare’s reverse proxy service expands the 5xx series of errors space to signal issues with the origin server.^[50]

520 Web Server Returned an Unknown Error: The origin server returned an empty, unknown, or unexpected response to Cloudflare.^[51]
521 Web Server Is Down: The origin server refused connections from Cloudflare. Security solutions at the origin may be blocking legitimate connections from certain Cloudflare IP addresses.
522 Connection Timed Out: Cloudflare timed out contacting the origin server.
523 Origin Is Unreachable: Cloudflare could not reach the origin server; for example, if the DNS records for the origin server are incorrect or missing.
524 A Timeout Occurred: Cloudflare was able to complete a TCP connection to the origin server, but did not receive a timely HTTP response.
525 SSL Handshake Failed: Cloudflare could not negotiate a SSL/TLS handshake with the origin server.
526 Invalid SSL Certificate: Cloudflare could not validate the SSL certificate on the origin web server. Also used by Cloud Foundry’s gorouter.
527 Railgun Error: Error 527 indicates an interrupted connection between Cloudflare and the origin server’s Railgun server.^[52]
530: Error 530 is returned along with a 1xxx error.^[53]

AWS Elastic Load Balancer

Amazon’s Elastic Load Balancing adds a few custom return codes

460: Client closed the connection with the load balancer before the idle timeout period elapsed. Typically when client timeout is sooner than the Elastic Load Balancer’s timeout.^[54]
463: The load balancer received an X-Forwarded-For request header with more than 30 IP addresses.^[54]
561 Unauthorized: An error around authentication returned by a server registered with a load balancer. You configured a listener rule to authenticate users, but the identity provider (IdP) returned an error code when authenticating the user.^[55]

Caching warning codes (obsoleted)

The following caching related warning codes were specified under RFC 7234. Unlike the other status codes above, these were not sent as the response status in the HTTP protocol, but as part of the «Warning» HTTP header.^[56]^[57]

Since this «Warning» header is often neither sent by servers nor acknowledged by clients, this header and its codes were obsoleted by the HTTP Working Group in 2022 with RFC 9111.^[58]

110 Response is Stale: The response provided by a cache is stale (the content’s age exceeds a maximum age set by a Cache-Control header or heuristically chosen lifetime).
111 Revalidation Failed: The cache was unable to validate the response, due to an inability to reach the origin server.
112 Disconnected Operation: The cache is intentionally disconnected from the rest of the network.
113 Heuristic Expiration: The cache heuristically chose a freshness lifetime greater than 24 hours and the response’s age is greater than 24 hours.
199 Miscellaneous Warning: Arbitrary, non-specific warning. The warning text may be logged or presented to the user.
214 Transformation Applied: Added by a proxy if it applies any transformation to the representation, such as changing the content encoding, media type or the like.
299 Miscellaneous Persistent Warning: Same as 199, but indicating a persistent warning.

Explanatory notes

^ Emphasised words and phrases such as must and should represent interpretation guidelines as given by RFC 2119

References

^ ^a ^b ^c «Hypertext Transfer Protocol (HTTP) Status Code Registry». Iana.org. Archived from the original on December 11, 2011. Retrieved January 8, 2015.
^ «RFC 9110: HTTP Semantics and Content, Section 10.1.1 «Expect»«.
^ Goland, Yaronn; Whitehead, Jim; Faizi, Asad; Carter, Steve R.; Jensen, Del (February 1999). HTTP Extensions for Distributed Authoring – WEBDAV. IETF. doi:10.17487/RFC2518. RFC 2518. Retrieved October 24, 2009.
^ Oku, Kazuho (December 2017). An HTTP Status Code for Indicating Hints. IETF. doi:10.17487/RFC8297. RFC 8297. Retrieved December 20, 2017.
^ Stewart, Mark; djna. «Create request with POST, which response codes 200 or 201 and content». Stack Overflow. Archived from the original on October 11, 2016. Retrieved October 16, 2015.
^ «RFC 9110: HTTP Semantics and Content, Section 15.3.4».
^ «RFC 9110: HTTP Semantics and Content, Section 7.7».
^ ^a ^b ^c ^d ^e Dusseault, Lisa, ed. (June 2007). HTTP Extensions for Web Distributed Authoring and Versioning (WebDAV). IETF. doi:10.17487/RFC4918. RFC 4918. Retrieved October 24, 2009.
^ Delta encoding in HTTP. IETF. January 2002. doi:10.17487/RFC3229. RFC 3229. Retrieved February 25, 2011.
^ ^a ^b «RFC 9110: HTTP Semantics and Content, Section 15.4 «Redirection 3xx»«.
^ Berners-Lee, Tim; Fielding, Roy T.; Nielsen, Henrik Frystyk (May 1996). Hypertext Transfer Protocol – HTTP/1.0. IETF. doi:10.17487/RFC1945. RFC 1945. Retrieved October 24, 2009.
^ «The GNU Taler tutorial for PHP Web shop developers 0.4.0». docs.taler.net. Archived from the original on November 8, 2017. Retrieved October 29, 2017.
^ «Google API Standard Error Responses». 2016. Archived from the original on May 25, 2017. Retrieved June 21, 2017.
^ «Sipgate API Documentation». Archived from the original on July 10, 2018. Retrieved July 10, 2018.
^ «Shopify Documentation». Archived from the original on July 25, 2018. Retrieved July 25, 2018.
^ «Stripe API Reference – Errors». stripe.com. Retrieved October 28, 2019.
^ «RFC2616 on status 413». Tools.ietf.org. Archived from the original on March 7, 2011. Retrieved November 11, 2015.
^ «RFC2616 on status 414». Tools.ietf.org. Archived from the original on March 7, 2011. Retrieved November 11, 2015.
^ «RFC2616 on status 416». Tools.ietf.org. Archived from the original on March 7, 2011. Retrieved November 11, 2015.
^ TheDeadLike. «HTTP/1.1 Status Codes 400 and 417, cannot choose which». serverFault. Archived from the original on October 10, 2015. Retrieved October 16, 2015.
^ Larry Masinter (April 1, 1998). Hyper Text Coffee Pot Control Protocol (HTCPCP/1.0). doi:10.17487/RFC2324. RFC 2324. Any attempt to brew coffee with a teapot should result in the error code «418 I’m a teapot». The resulting entity body MAY be short and stout.
^ I’m a teapot
^ Barry Schwartz (August 26, 2014). «New Google Easter Egg For SEO Geeks: Server Status 418, I’m A Teapot». Search Engine Land. Archived from the original on November 15, 2015. Retrieved November 4, 2015.
^ «Google’s Teapot». Retrieved October 23, 2017.^{[dead link]}
^ «Enable extra web security on a website». DreamHost. Retrieved December 18, 2022.
^ «I Went to a Russian Website and All I Got Was This Lousy Teapot». PCMag. Retrieved December 18, 2022.
^ ^a ^b ^c ^d Nottingham, M.; Fielding, R. (April 2012). «RFC 6585 – Additional HTTP Status Codes». Request for Comments. Internet Engineering Task Force. Archived from the original on May 4, 2012. Retrieved May 1, 2012.
^ Bray, T. (February 2016). «An HTTP Status Code to Report Legal Obstacles». ietf.org. Archived from the original on March 4, 2016. Retrieved March 7, 2015.
^ alex. «What is the correct HTTP status code to send when a site is down for maintenance?». Stack Overflow. Archived from the original on October 11, 2016. Retrieved October 16, 2015.
^ Holtman, Koen; Mutz, Andrew H. (March 1998). Transparent Content Negotiation in HTTP. IETF. doi:10.17487/RFC2295. RFC 2295. Retrieved October 24, 2009.
^ Nielsen, Henrik Frystyk; Leach, Paul; Lawrence, Scott (February 2000). An HTTP Extension Framework. IETF. doi:10.17487/RFC2774. RFC 2774. Retrieved October 24, 2009.
^ «Enum HttpStatus». Spring Framework. org.springframework.http. Archived from the original on October 25, 2015. Retrieved October 16, 2015.
^ «Twitter Error Codes & Responses». Twitter. 2014. Archived from the original on September 27, 2017. Retrieved January 20, 2014.
^ «HTTP Status Codes and SEO: what you need to know». ContentKing. Retrieved August 9, 2019.
^ «Screenshot of error page». Archived from the original (bmp) on May 11, 2013. Retrieved October 11, 2009.
^ ^a ^b «Using token-based authentication». ArcGIS Server SOAP SDK. Archived from the original on September 26, 2014. Retrieved September 8, 2014.
^ «HTTP Error Codes and Quick Fixes». Docs.cpanel.net. Archived from the original on November 23, 2015. Retrieved October 15, 2015.
^ «SSL Labs API v3 Documentation». github.com.
^ «Platform Considerations | Pantheon Docs». pantheon.io. Archived from the original on January 6, 2017. Retrieved January 5, 2017.
^ «HTTP status codes — ascii-code.com». www.ascii-code.com. Archived from the original on January 7, 2017. Retrieved December 23, 2016.
^
«Error message when you try to log on to Exchange 2007 by using Outlook Web Access: «440 Login Time-out»«. Microsoft. 2010. Retrieved November 13, 2013.
^ «2.2.6 449 Retry With Status Code». Microsoft. 2009. Archived from the original on October 5, 2009. Retrieved October 26, 2009.
^ «MS-ASCMD, Section 3.1.5.2.2». Msdn.microsoft.com. Archived from the original on March 26, 2015. Retrieved January 8, 2015.
^ «Ms-oxdisco». Msdn.microsoft.com. Archived from the original on July 31, 2014. Retrieved January 8, 2015.
^ «The HTTP status codes in IIS 7.0». Microsoft. July 14, 2009. Archived from the original on April 9, 2009. Retrieved April 1, 2009.
^ «ngx_http_request.h». nginx 1.9.5 source code. nginx inc. Archived from the original on September 19, 2017. Retrieved January 9, 2016.
^ «ngx_http_special_response.c». nginx 1.9.5 source code. nginx inc. Archived from the original on May 8, 2018. Retrieved January 9, 2016.
^ «return» directive Archived March 1, 2018, at the Wayback Machine (http_rewrite module) documentation.
^ «Troubleshooting: Error Pages». Cloudflare. Archived from the original on March 4, 2016. Retrieved January 9, 2016.
^ «Error 520: web server returns an unknown error». Cloudflare. Retrieved November 1, 2019.
^ «527 Error: Railgun Listener to origin error». Cloudflare. Archived from the original on October 13, 2016. Retrieved October 12, 2016.
^ «Error 530». Cloudflare. Retrieved November 1, 2019.
^ ^a ^b «Troubleshoot Your Application Load Balancers – Elastic Load Balancing». docs.aws.amazon.com. Retrieved August 27, 2019.
^ «Troubleshoot your Application Load Balancers — Elastic Load Balancing». docs.aws.amazon.com. Retrieved January 24, 2021.
^ «Hypertext Transfer Protocol (HTTP/1.1): Caching». datatracker.ietf.org. Retrieved September 25, 2021.
^ «Warning — HTTP | MDN». developer.mozilla.org. Retrieved August 15, 2021. Some text was copied from this source, which is available under a Creative Commons Attribution-ShareAlike 2.5 Generic (CC BY-SA 2.5) license.
^ «RFC 9111: HTTP Caching, Section 5.5 «Warning»«. June 2022.

External links

«RFC 9110: HTTP Semantics and Content, Section 15 «Status Codes»«.
Hypertext Transfer Protocol (HTTP) Status Code Registry

Источник

THE INFORMATION IN THIS ARTICLE APPLIES TO:

All GlobalSCAPE products, all versions
Refer to https://kb.globalscape.com/KnowledgebaseArticle11144.aspx for EFT-specific HTTP error codes

DISCUSSION

During your HTTP sessions, you’ll receive various numbered codes from Web servers. When connected via HTTP, CuteFTP and HTTP servers to which you connect can display these codes in the log window. Some codes represent errors. Most others simply communicate the status of the connection. Here are brief explanations for the most common status and error codes.

The list below are standard HTTP codes. Numbers outside this list are proprietary to the Server or Client that you are using.

Error or Status Code	Description
100 Series	Informational — These status codes indicate a provisional response. The client should be prepared to receive one or more 1xx responses before receiving a regular response.
100	Continue.
101	Switching protocols.

200 Series	Success — This class of status codes indicates that the server successfully accepted the client request.
200	The client request has succeeded. This status code indicates that the Web server has successfully processed the request.
201	Created.
202	Accepted.
203	Non-authoritative information.
204	No content.
205	Reset content.
206	Partial content.

300 Series	Redirection — The client browser must take more action to fulfill the request. For example, the browser may have to request a different page on the server or repeat the request by using a proxy server.
302	Object moved.
304	Not modified. The client requests a document that is already in its cache and the document has not been modified since it was cached. The client uses the cached copy of the document, instead of downloading it from the server
307	Temporary redirect.

400 Series	Client Error — An error occurs, and the client appears to be at fault. For example, the client may request a page that does not exist, or the client may not provide valid authentication information.
400	Bad request.
401	Access denied.
401.1	Logon failed. The logon attempt is unsuccessful, probably because of a user name or password that is not valid.
401.2	Logon failed due to server configuration.
401.3	Unauthorized due to ACL on resource. This indicates a problem with NTFS permissions. This error may occur even if the permissions are correct for the file that you are trying to access. For example, you see this error if the IUSR account does not have access to the C:WinntSystem32Inetsrv directory.
401.4	Authorization failed by filter.
401.5	Authorization failed by ISAPI/CGI application.
401.7	Access denied by URL authorization policy on the Web server. This error code is specific to IIS 6.0.
403	Forbidden.
403.1	Execute access forbidden. The following are two common causes of this error message: You do not have enough Execute permissions. For example, you may receive this error message if you try to access an ASP page in a directory where permissions are set to None, or you try to execute a CGI script in a directory with Scripts Only permissions. The script mapping for the file type that you are trying to execute is not set up to recognize the verb that you are using (for example, GET or POST).
403.2	Read access forbidden. Verify that you have Read access to the directory. Also, if you are using a default document, verify that the document exists.
403.3	Write access forbidden. Verify that you have Write access to the directory
403.4	SSL required. Use HTTPS instead of HTTP to access the page.
403.5	SSL 128 required.
403.6	IP address rejected.
403.7	Client certificate required. You do not have a valid client certificate installed
403.8	Site access denied.
403.9	Too many users. The number of users who are connected to the server exceeds the connection limit.
403.10	Invalid configuration.
403.11	Password change.
403.12	Mapper denied access. The page that you want to access requires a client certificate, but the user ID that is mapped to your client certificate has been denied access to the file.
403.13	Client certificate revoked.
403.14	Directory listing denied.
403.15	Client Access Licenses exceeded.
403.16	Client certificate is untrusted or invalid.
403.17	Client certificate has expired or is not yet valid.
403.18	Cannot execute requested URL in the current application pool. This error code is specific to IIS 6.0.
403.19	Cannot execute CGIs for the client in this application pool. This error code is specific to IIS 6.0.
403.20	Passport logon failed. This error code is specific to IIS 6.0.
404	Not found. This error may occur if the file that you are trying to access has been moved or deleted.
404.0	File or directory not found.
404.1	Web site not accessible on the requested port.
404.2	Web service extension lockdown policy prevents this request.
404.3	MIME map policy prevents this request.
405	HTTP verb used to access this page is not allowed (method not allowed).
406	Client browser does not accept the MIME type of the requested page.
407	Proxy authentication required.
412	Precondition failed.
413	Request entity too large.
414	Request-URL too long.
415	Unsupported media type.
416	Requested range not satisfiable.
417	Execution failed.
423	Locked error.

500 Series	Server Error — The server cannot complete the request because it encounters an error.
500	Internal server error. You see this error message for a wide variety of server-side errors.
500.12	Application is busy restarting on the Web server. Indicates that you tried to load an ASP page while IIS was in the process of restarting the application. This message should disappear when you refresh the page. If you refresh the page and the message appears again, it may be caused by antivirus software that is scanning your Global.asa file.
500.13	Web server is too busy.
500.15	Direct requests for Global.asa are not allowed.
500.16	UNC authorization credentials incorrect. This error code is specific to IIS 6.0.
500.18	URL authorization store cannot be opened. This error code is specific to IIS 6.0.
500.100	Internal ASP error. You receive this error message when you try to load an ASP page that has errors in the code.
501	Header values specify a configuration that is not implemented.
502	Bad Gateway. Web server received an invalid response while acting as a gateway or proxy. You receive this error message when you try to run a CGI script that does not return a valid set of HTTP headers.
502.1	CGI application timeout.
502.2	Error in CGI application.
503	Service unavailable. This error code is specific to IIS 6.0.
504	Gateway timeout.
505	HTTP version not supported.

Источник

A clear explanation from Daniel Irvine ^{[original link]}:

There’s a problem with 401 Unauthorized, the HTTP status code for authentication errors. And that’s just it: it’s for authentication, not authorization.
Receiving a 401 response is the server telling you, “you aren’t
authenticated–either not authenticated at all or authenticated
incorrectly–but please reauthenticate and try again.” To help you out,
it will always include a WWW-Authenticate header that describes how
to authenticate.

This is a response generally returned by your web server, not your web
application.

It’s also something very temporary; the server is asking you to try
again.

So, for authorization I use the 403 Forbidden response. It’s
permanent, it’s tied to my application logic, and it’s a more concrete
response than a 401.

Receiving a 403 response is the server telling you, “I’m sorry. I know
who you are–I believe who you say you are–but you just don’t have
permission to access this resource. Maybe if you ask the system
administrator nicely, you’ll get permission. But please don’t bother
me again until your predicament changes.”

In summary, a 401 Unauthorized response should be used for missing
or bad authentication, and a 403 Forbidden response should be used
afterwards, when the user is authenticated but isn’t authorized to
perform the requested operation on the given resource.

Another nice pictorial format of how http status codes should be used.

Nick T

25.2k11 gold badges79 silver badges120 bronze badges

answered Aug 4, 2011 at 6:24

Edit: RFC2616 is obsolete, see RFC9110.

401 Unauthorized:

If the request already included Authorization credentials, then the 401 response indicates that authorization has been refused for those credentials.

403 Forbidden:

The server understood the request, but is refusing to fulfill it.

From your use case, it appears that the user is not authenticated. I would return 401.

emery

8,03510 gold badges42 silver badges49 bronze badges

answered Jul 21, 2010 at 7:28

OdedOded

485k98 gold badges877 silver badges1003 bronze badges

Something the other answers are missing is that it must be understood that Authentication and Authorization in the context of RFC 2616 refers ONLY to the HTTP Authentication protocol of RFC 2617. Authentication by schemes outside of RFC2617 is not supported in HTTP status codes and are not considered when deciding whether to use 401 or 403.

Brief and Terse

Unauthorized indicates that the client is not RFC2617 authenticated and the server is initiating the authentication process. Forbidden indicates either that the client is RFC2617 authenticated and does not have authorization or that the server does not support RFC2617 for the requested resource.

Meaning if you have your own roll-your-own login process and never use HTTP Authentication, 403 is always the proper response and 401 should never be used.

Detailed and In-Depth

From RFC2616

10.4.2 401 Unauthorized

The request requires user authentication. The response MUST include a WWW-Authenticate header field (section 14.47) containing a challenge applicable to the requested resource. The client MAY repeat the request with a suitable Authorization header field (section 14.8).

and

10.4.4 403 Forbidden
The server understood the request but is refusing to fulfil it. Authorization will not help and the request SHOULD NOT be repeated.

The first thing to keep in mind is that «Authentication» and «Authorization» in the context of this document refer specifically to the HTTP Authentication protocols from RFC 2617. They do not refer to any roll-your-own authentication protocols you may have created using login pages, etc. I will use «login» to refer to authentication and authorization by methods other than RFC2617

So the real difference is not what the problem is or even if there is a solution. The difference is what the server expects the client to do next.

401 indicates that the resource can not be provided, but the server is REQUESTING that the client log in through HTTP Authentication and has sent reply headers to initiate the process. Possibly there are authorizations that will permit access to the resource, possibly there are not, but let’s give it a try and see what happens.

403 indicates that the resource can not be provided and there is, for the current user, no way to solve this through RFC2617 and no point in trying. This may be because it is known that no level of authentication is sufficient (for instance because of an IP blacklist), but it may be because the user is already authenticated and does not have authority. The RFC2617 model is one-user, one-credentials so the case where the user may have a second set of credentials that could be authorized may be ignored. It neither suggests nor implies that some sort of login page or other non-RFC2617 authentication protocol may or may not help — that is outside the RFC2616 standards and definition.

Edit: RFC2616 is obsolete, see RFC7231 and RFC7235.

answered Feb 5, 2013 at 17:14

ldrutldrut

3,7771 gold badge17 silver badges4 bronze badges

  +-----------------------
  | RESOURCE EXISTS ? (if private it is often checked AFTER auth check)
  +-----------------------
    |       |
 NO |       v YES
    v      +-----------------------
   404     | IS LOGGED-IN ? (authenticated, aka user session)
   or      +-----------------------
   401        |              |
   403     NO |              | YES
   3xx        v              v
              401            +-----------------------
       (404 no reveal)       | CAN ACCESS RESOURCE ? (permission, authorized, ...)
              or             +-----------------------
             redirect          |            |
             to login       NO |            | YES
                               |            |
                               v            v
                               403          OK 200, redirect, ...
                      (or 404: no reveal)
                      (or 404: resource does not exist if private)
                      (or 3xx: redirection)

Checks are usually done in this order:

404 if resource is public and does not exist or 3xx redirection
OTHERWISE:
401 if not logged-in or session expired
403 if user does not have permission to access resource (file, json, …)
404 if resource does not exist or not willing to reveal anything, or 3xx redirection

UNAUTHORIZED: Status code (401) indicating that the request requires authentication, usually this means user needs to be logged-in (session). User/agent unknown by the server. Can repeat with other credentials. NOTE: This is confusing as this should have been named ‘unauthenticated’ instead of ‘unauthorized’. This can also happen after login if session expired.
Special case: Can be used instead of 404 to avoid revealing presence or non-presence of resource (credits @gingerCodeNinja)

FORBIDDEN: Status code (403) indicating the server understood the request but refused to fulfill it. User/agent known by the server but has insufficient credentials. Repeating request will not work, unless credentials changed, which is very unlikely in a short time span.
Special case: Can be used instead of 404 to avoid revealing presence or non-presence of resource (credits @gingerCodeNinja) in the case that revealing the presence of the resource exposes sensitive data or gives an attacker useful information.

NOT FOUND: Status code (404) indicating that the requested resource is not available. User/agent known but server will not reveal anything about the resource, does as if it does not exist. Repeating will not work. This is a special use of 404 (github does it for example).

As mentioned by @ChrisH there are a few options for redirection 3xx (301, 302, 303, 307 or not redirecting at all and using a 401):

Difference between HTTP redirect codes
How long do browsers cache HTTP 301s?
What is correct HTTP status code when redirecting to a login page?
What’s the difference between a 302 and a 307 redirect?

answered Feb 23, 2015 at 11:00

According to RFC 2616 (HTTP/1.1) 403 is sent when:

The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. If the server does not wish to make this information available to the client, the status code 404 (Not Found) can be used instead

In other words, if the client CAN get access to the resource by authenticating, 401 should be sent.

answered Jul 21, 2010 at 7:26

CumbayahCumbayah

4,3771 gold badge24 silver badges32 bronze badges

Assuming HTTP authentication (WWW-Authenticate and Authorization headers) is in use, if authenticating as another user would grant access to the requested resource, then 401 Unauthorized should be returned.

403 Forbidden is used when access to the resource is forbidden to everyone or restricted to a given network or allowed only over SSL, whatever as long as it is no related to HTTP authentication.

If HTTP authentication is not in use and the service has a cookie-based authentication scheme as is the norm nowadays, then a 403 or a 404 should be returned.

Regarding 401, this is from RFC 7235 (Hypertext Transfer Protocol (HTTP/1.1): Authentication):

3.1. 401 Unauthorized

The 401 (Unauthorized) status code indicates that the request has not been applied because it lacks valid authentication credentials for the target resource. The origin server MUST send a WWW-Authenticate header field (Section 4.4) containing at least one challenge applicable to the target resource. If the request included authentication credentials, then the 401 response indicates that authorization has been refused for those credentials. The client MAY repeat the request with a new or replaced Authorization header field (Section 4.1). If the 401 response contains the same challenge as the prior response, and the user agent has already attempted authentication at least once, then the user agent SHOULD present the enclosed representation to the user, since it usually contains relevant diagnostic information.

The semantics of 403 (and 404) have changed over time. This is from 1999 (RFC 2616):

10.4.4 403 Forbidden

The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. If the server does not wish to make this information available to the client, the status code 404 (Not Found) can be used instead.

In 2014 RFC 7231 (Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content) changed the meaning of 403:

6.5.3. 403 Forbidden

The 403 (Forbidden) status code indicates that the server understood the request but refuses to authorize it. A server that wishes to make public why the request has been forbidden can describe that reason in the response payload (if any).

If authentication credentials were provided in the request, the server considers them insufficient to grant access. The client SHOULD NOT automatically repeat the request with the same credentials. The client MAY repeat the request with new or different credentials. However, a request might be forbidden for reasons unrelated to the credentials.

An origin server that wishes to «hide» the current existence of a forbidden target resource MAY instead respond with a status code of 404 (Not Found).

Thus, a 403 (or a 404) might now mean about anything. Providing new credentials might help… or it might not.

I believe the reason why this has changed is RFC 2616 assumed HTTP authentication would be used when in practice today’s Web apps build custom authentication schemes using for example forms and cookies.

answered Feb 27, 2013 at 9:44

401 Unauthorized: I don’t know who you are. This an authentication error.
403 Forbidden: I know who you are, but you don’t have permission to access this resource. This is an authorization error.

Premraj

72.1k25 gold badges236 silver badges175 bronze badges

answered Aug 6, 2019 at 12:37

This is an older question, but one option that was never really brought up was to return a 404. From a security perspective, the highest voted answer suffers from a potential information leakage vulnerability. Say, for instance, that the secure web page in question is a system admin page, or perhaps more commonly, is a record in a system that the user doesn’t have access to. Ideally you wouldn’t want a malicious user to even know that there’s a page / record there, let alone that they don’t have access. When I’m building something like this, I’ll try to record unauthenticate / unauthorized requests in an internal log, but return a 404.

OWASP has some more information about how an attacker could use this type of information as part of an attack.

answered Dec 25, 2014 at 9:09

This question was asked some time ago, but people’s thinking moves on.

Section 6.5.3 in this draft (authored by Fielding and Reschke) gives status code 403 a slightly different meaning to the one documented in RFC 2616.

It reflects what happens in authentication & authorization schemes employed by a number of popular web-servers and frameworks.

I’ve emphasized the bit I think is most salient.

6.5.3. 403 Forbidden

The 403 (Forbidden) status code indicates that the server understood the request but refuses to authorize it. A server that wishes to make public why the request has been forbidden can describe that reason in the response payload (if any).

If authentication credentials were provided in the request, the server considers them insufficient to grant access. The client SHOULD NOT repeat the request with the same credentials. The client MAY repeat the request with new or different credentials. However, a request might be forbidden for reasons unrelated to the credentials.

An origin server that wishes to «hide» the current existence of a forbidden target resource MAY instead respond with a status code of 404 (Not Found).

Whatever convention you use, the important thing is to provide uniformity across your site / API.

answered May 22, 2014 at 10:54

Dave WattsDave Watts

8407 silver badges11 bronze badges

These are the meanings:

401: User not (correctly) authenticated, the resource/page require authentication

403: User’s role or permissions does not allow to access requested resource, for instance user is not an administrator and requested page is for administrators.

Note: Technically, 403 is a superset of 401, since is legal to give 403 for unauthenticated user too. Anyway is more meaningful to differentiate.

answered Nov 19, 2019 at 10:17

Luca C.Luca C.

11.1k1 gold badge86 silver badges77 bronze badges

!!! DEPR: The answer reflects what used to be common practice, up until 2014 !!!

TL;DR

401: A refusal that has to do with authentication
403: A refusal that has NOTHING to do with authentication

Practical Examples

If apache requires authentication (via .htaccess), and you hit Cancel, it will respond with a 401 Authorization Required

If nginx finds a file, but has no access rights (user/group) to read/access it, it will respond with 403 Forbidden

RFC (2616 Section 10)

401 Unauthorized (10.4.2)

Meaning 1: Need to authenticate

The request requires user authentication. …

Meaning 2: Authentication insufficient

… If the request already included Authorization credentials, then the 401 response indicates that authorization has been refused for those credentials. …

403 Forbidden (10.4.4)

Meaning: Unrelated to authentication

… Authorization will not help …

More details:

The server understood the request, but is refusing to fulfill it.

It SHOULD describe the reason for the refusal in the entity

The status code 404 (Not Found) can be used instead

(If the server wants to keep this information from client)

answered Feb 25, 2015 at 9:03

LeviteLevite

16.9k8 gold badges50 silver badges50 bronze badges

they are not logged in or do not belong to the proper user group

You have stated two different cases; each case should have a different response:

If they are not logged in at all you should return 401 Unauthorized
If they are logged in but don’t belong to the proper user group, you should return 403 Forbidden

Note on the RFC based on comments received to this answer:

If the user is not logged in they are un-authenticated, the HTTP equivalent of which is 401 and is misleadingly called Unauthorized in the RFC. As section 10.4.2 states for 401 Unauthorized:

«The request requires user authentication.»

If you’re unauthenticated, 401 is the correct response. However if you’re unauthorized, in the semantically correct sense, 403 is the correct response.

answered Oct 1, 2012 at 14:34

Zaid MasudZaid Masud

13.1k9 gold badges66 silver badges88 bronze badges

I have created a simple note for you which will make it clear.

answered Nov 11, 2021 at 12:19

PrathamPratham

4673 silver badges7 bronze badges

In English:

401

You are potentially allowed access but for some reason on this request you were
denied. Such as a bad password? Try again, with the correct request
you will get a success response instead.

403

You are not, ever, allowed. Your name is not on the list, you won’t
ever get in, go away, don’t send a re-try request, it will be refused,
always. Go away.

answered Apr 8, 2020 at 14:23

JamesJames

4,6155 gold badges36 silver badges48 bronze badges

401: You need HTTP basic auth to see this.

If the user just needs to log in using you site’s standard HTML login form, 401 would not be appropriate because it is specific to HTTP basic auth.

403: This resource exists but you are not authorized to see it, and HTTP basic auth won’t help.

I don’t recommend using 403 to deny access to things like /includes, because as far as the web is concerned, those resources don’t exist at all and should therefore 404.

In other words, 403 means «this resource requires some form of auth other than HTTP basic auth (such as using the web site’s standard HTML login form)».

https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.2

answered Sep 23, 2017 at 12:33

Vlad KorneaVlad Kornea

4,2493 gold badges38 silver badges40 bronze badges

401: Who are you again?? (programmer walks into a bar with no ID or invalid ID)

403: Oh great, you again. I’ve got my eye on you. Go on, get outta here. (programmer walks into a bar they are 86’d from)

answered Aug 11, 2022 at 23:10

emeryemery

8,03510 gold badges42 silver badges49 bronze badges

I think it is important to consider that, to a browser, 401 initiates an authentication dialog for the user to enter new credentials, while 403 does not. Browsers think that, if a 401 is returned, then the user should re-authenticate. So 401 stands for invalid authentication while 403 stands for a lack of permission.

Here are some cases under that logic where an error would be returned from authentication or authorization, with important phrases bolded.

A resource requires authentication but no credentials were specified.

401: The client should specify credentials.

The specified credentials are in an invalid format.

400: That’s neither 401 nor 403, as syntax errors should always return 400.

The specified credentials reference a user which does not exist.

401: The client should specify valid credentials.

The specified credentials are invalid but specify a valid user (or don’t specify a user if a specified user is not required).

401: Again, the client should specify valid credentials.

The specified credentials have expired.

401: This is practically the same as having invalid credentials in general, so the client should specify valid credentials.

The specified credentials are completely valid but do not suffice the particular resource, though it is possible that credentials with more permission could.

403: Specifying valid credentials would not grant access to the resource, as the current credentials are already valid but only do not have permission.

The particular resource is inaccessible regardless of credentials.

403: This is regardless of credentials, so specifying valid credentials cannot help.

The specified credentials are completely valid but the particular client is blocked from using them.

403: If the client is blocked, specifying new credentials will not do anything.

answered Jun 2, 2018 at 23:34

401 response means one of the following:

An access token is missing.
An access token is either expired, revoked, malformed, or invalid.

403 response on the other hand means that the access token is indeed valid, but that the user does not have appropriate privileges to perform the requested action.

answered Feb 17, 2022 at 11:16

Ran TurnerRan Turner

12.7k4 gold badges38 silver badges48 bronze badges

Given the latest RFC’s on the matter (7231 and 7235) the use-case seems quite clear (italics added):

401 is for unauthenticated («lacks valid authentication»); i.e. ‘I don’t know who you are, or I don’t trust you are who you say you are.’

401 Unauthorized

The 401 (Unauthorized) status code indicates that the request has not
been applied because it lacks valid authentication credentials for
the target resource. The server generating a 401 response MUST send
a WWW-Authenticate header field (Section 4.1) containing at least one
challenge applicable to the target resource.

If the request included authentication credentials, then the 401
response indicates that authorization has been refused for those
credentials. The user agent MAY repeat the request with a new or
replaced Authorization header field (Section 4.2). If the 401
response contains the same challenge as the prior response, and the
user agent has already attempted authentication at least once, then
the user agent SHOULD present the enclosed representation to the
user, since it usually contains relevant diagnostic information.

403 is for unauthorized («refuses to authorize»); i.e. ‘I know who you are, but you don’t have permission to access this resource.’

403 Forbidden

The 403 (Forbidden) status code indicates that the server understood
the request but refuses to authorize it. A server that wishes to
make public why the request has been forbidden can describe that
reason in the response payload (if any).

If authentication credentials were provided in the request, the
server considers them insufficient to grant access. The client
SHOULD NOT automatically repeat the request with the same
credentials. The client MAY repeat the request with new or different
credentials. However, a request might be forbidden for reasons
unrelated to the credentials.

An origin server that wishes to «hide» the current existence of a
forbidden target resource MAY instead respond with a status code of
404 (Not Found).

answered Jun 5, 2018 at 15:26

cjbarthcjbarth

4,0526 gold badges41 silver badges60 bronze badges

I have a slightly different take on it from the accepted answer.

It seems more semantic and logical to return a 403 when authentication fails and a 401 when authorisation fails.

Here is my reasoning for this:

When you are requesting to be authenticated, You are authorised to make that request. You need to otherwise no one would even be able to be authenticated in the first place.

If your authentication fails you are forbidden, that makes semantic sense.

On the other hand the forbidden can also apply for Authorisation, but
Say you are authenticated and you are not authorised to access a particular endpoint. It seems more semantic to return a 401 Unauthorised.

Spring Boot’s security returns 403 for a failed authentication attempt

answered Apr 6, 2022 at 22:44

theMyththeMyth

2544 silver badges14 bronze badges

In the case of 401 vs 403, this has been answered many times. This is essentially a ‘HTTP request environment’ debate, not an ‘application’ debate.

There seems to be a question on the roll-your-own-login issue (application).

In this case, simply not being logged in is not sufficient to send a 401 or a 403, unless you use HTTP Auth vs a login page (not tied to setting HTTP Auth). It sounds like you may be looking for a «201 Created», with a roll-your-own-login screen present (instead of the requested resource) for the application-level access to a file. This says:

«I heard you, it’s here, but try this instead (you are not allowed to see it)»

answered Dec 12, 2014 at 19:01

Источник

Что это такое? Ошибка 403, возникшая на экране смартфона, ПК или планшета, говорит вам: «Сюда вход запрещен». Считается серверной ошибкой, однако это не технический сбой. Спровоцировать ее могут проделки провайдеров или мошенников.

Как устранить? Если ошибка 403 – дело рук хакеров, то придется пофиксить в настройках сайта. Если же сайт не открывается у пользователей всей страны (заблокировали по первым цифрам IP), то и здесь решить проблему можно. Для обхода запрета есть специальные сервисы.

В статье рассказывается:

Что означает ошибка 403
Причины появления ошибки 403
Как решить проблему, если вы – пользователь
Способ обхода ошибки 403
Топ-7 прокси-серверов для обхода ошибки 403
Как устранить ошибку 403 в Play Market
Как исправить ошибку 403 в Крыму
Как обойти ошибку 403 в Netflix

Многие пользователи впадают в недоумение, увидев сообщение «403 forbidden», и задаются вопросом, что это за ошибка. Если браузер отправил ее, это значит, что доступ к запрашиваемому ресурсу ограничен. Эта ошибка может быть отображена и по-другому:

403 Forbidden.
Access denied.
«В доступе отказано».
Forbidden.
You don’t have permission to access.
Запрещено 403.

Когда в сообщении об ошибке будет указан код 403, то практически во всех случаях потребуется использование стороннего программного обеспечения либо выход в Интернет через удаленный сервер.

Такое сообщение не связано с техническими неполадками, оно дает понять, что доступ к ресурсу ограничен самим провайдером.

Ошибка 403 может появиться при попытке открыть любой сайт, страницу, файл, сценарий, к которым по тем или иным причинам решено ограничить доступ пользователя.

Причины появления ошибки 403

Существует целый ряд причин, по которым пользователь может увидеть ошибку запроса 403. Таковыми могут быть как случайные или ошибочные действия провайдера, так и намеренное ограничение доступа, обусловленное политическими мотивами, соображениями безопасности данных, неготовностью материалов к публикации. Подробнее о разных вариантах.

Доступ к ресурсу может быть ограничен для пользователя из какой-либо страны

Сразу, как только пользователь выходит в Интернет, он получает IP-адрес. По нему происходит обмен данными между его устройством и любым интернет-ресурсом. IP представляет собой набор цифр, разделенных точками на четыре части по два или три знака. Первые цифры в этом коде указывают на страну, из которой осуществляется доступ к серверу.

В частности, один из самых посещаемых в мире поисковик Google в ряде стран невозможно открыть из-за ограничения доступа, поэтому пользователи из этих стран видят ошибку 403 при попытке зайти на него. Характерным примером подобной ситуации являются непростые отношения России с целым рядом зарубежных государств, из-за чего вне закона оказалось множество популярных иностранных ресурсов. Заходя на них, пользователи из России видят ошибку http 403. Кроме того, на устаревшем оборудовании провайдера при присвоении пользователю IP-адреса может указываться недостоверный код страны.

Крайне низка вероятность того, что ошибка 403 связана с тем, что сервер запретил доступ именно конкретному пользователю. Это возможно при наличии выделенной линии, при которой IP-адрес не изменяется при каждом подключении. В большинстве же случаев он присваивается заново при каждом доступе в Интернет, поэтому блокировка одного адреса не будет действовать при новом подключении. Если ошибка 403 появилась на сайте Гугл или на другом свободном в России ресурсе, следует попробовать переподключиться и зайти под другими логином и паролем. Иногда проблема решается автоматически по прошествии непродолжительного времени – не более нескольких дней.

В работе сайта возникли сбои в связи с изменениями, внесёнными в код

Если у вас в Сети создан свой сайт, то и здесь можно столкнуться с ошибкой авторизации 403. Причины могут быть следующие:

Сайт был взломан, в результате действий злоумышленников файл с индексными данными оказался поврежден;
при переносе ресурса его данные были размещены в месте хранения с неправильным адресом;
в вашем IP содержатся данные, при наличии которых доступ к сайту ограничен.

Индексные файлы – это записи сайта, к которым сервер при поступлении запроса от пользователя обращается в первую очередь, на основании данных, содержащихся в нем, уже обрабатываются остальные его данные. Если сервер управляется операционной системой Linux, то нужно быть внимательным к регистру при указании имени файла.

Собрали все фишки маркетинга в одном месте, чтобы вы смогли показать, что ваш продукт – лучший.

Для ресурсов, которые написаны на языке HTML и являются статичными, индексный файл будет иметь название Index и расширение html. Динамические сайты имеют index files с расширением php. У ресурса Joomla, например, два таких – Index1 и Index2. Индексный файл можно использовать из готового дистрибутива, распаковав его на локальном компьютере.

Может выясниться, что дистрибутив сайта помещен не в папку верхнего уровня, а в одну из подчиненных директорий, например, со сценариями, после чего появляется ошибка страницы 403. Не нужно тратить время на перенос данных, проще переименовать папки.

Для удаленных действий на сервере можно пользоваться протоколом FTP. Однако эффективнее будет выполнить вход непосредственно на server, поскольку так можно будет увидеть следы несанкционированных действий и обнаружить признаки вирусной атаки. Все действия на сайте фиксируются сервером с указанием их даты и времени. Вирусный код можно легко идентифицировать по записям типа ?php eval или iframe.

Если все указанные действия не помогают, остается только связаться с провайдером через службу техподдержки.

Браузер пишет «Ошибка 403», когда пользователь пытается загрузить конкретную страницу

Такие проблемы возникают гораздо чаще. В частности, если сайт был перемещен с локального сервера веб-разработчика на хостинг, как это произошло с площадкой Virtue Mart. На ней систематически возникают проблемы при нажатии кнопки «Купить».

Однако вместо страницы с данными о заказе пользователь видит ошибку 403. Вряд ли он станет думать, что делать, он просто сделает покупку в другом магазине. Поэтому в сфере интернет-торговли такие неполадки – просто непозволительная роскошь.

Отказы доступа к отдельным страницам сайта вызываются неверными настройками, которые указаны в корне сайта. Для управления нужными для открытия ресурса правами используется программа CHMOD, отличающаяся удобным интерфейсом. К каждой директории и любому файлу на сайте есть три уровня доступа:

хозяин сайта или суперпользователь;
группа доверенных лиц (администраторы);
посетители сайта.

С помощью программы CHMOD можно задать для страниц и папок действия, которые допускается совершать с ними тем или иным пользователям:

читать – обозначается цифрой 7 или буквой «r»;
редактировать (изменять) – цифра 7 или буква «w»;
исполнять – цифра 7 или буква «х».

Если файлу назначили права доступа 777 (в буквенном коде: rwx–rwx–rwx), то это означает, что любой пользователь Сети может совершать с ним действия наравне с хозяином сайта – изменять, удалять, редактировать данные.

Как создать продающий прайс-лист, чтобы клиенты отдали предпочтение вам, а не конкурентам.

Чаще всего встречается режим доступа 755 (в буквенном обозначении: rwx–r-x–r-x). Это значит, что редактировать файл может только суперпользователь, а администраторы и посетители сайта – только читать и исполнять. Буква «w» для суперпользователя позволяет получить ему неограниченный доступ к сайту. Знак «r», если он отсутствует в наборе прав хозяина, лишит доступа к сайту даже его. Ну а без режима «x» ни один посетитель не сможет оформить заказ и увидит ошибку браузера 403, как в случае с вышеупомянутым Virtue Mart.

В программе CHMOD все папки и файлы представляются в виде таблицы. Для изменения режима доступа достаточно кликнуть по соответствующей ячейке рядом с названием. Не зная, какой режим выбрать, указывайте 755, он подходит для большинства случаев.

Провоцируем 403 сами

Мы выяснили, что означает ошибка 403. Теперь разберемся, как воспроизвести ее самостоятельно. Например, вы хотите ограничить доступ какому-то пользователю или их группе по тому или иному признаку. В этом поможет файл .htaccess. В стандартном дистрибутиве CMS Joomla он называется htaccess.txt. Присвойте ему новое имя, поставив в начале заголовка точку. Также можно использовать программу Notepad ++, в ней нужно прописать следующее:

Этой командой вы ограничите возможность доступа к файлу всем пользователям, IP которых будет отличаться от указанного. Как вы помните, интернет-протокол большинства пользователей динамический, поэтому ограничения нужно указывать в директиве Deny. Третью и четвертую группу цифр в IP-адресе заполните нулями. Можно заблокировать пользователей из определённой страны. Так, например, если указать 81.4.0.0/14, то доступ к ресурсу не смогут получить все пользователи, интернет-протокол которых начинается с 81.4; на блокировку указывает число 14 после косой черты.

Чтобы установить IP-адрес злоумышленника, нужно воспользоваться одним из следующих вариантов:

компоненты CMS (форум) указывают этот адрес, и администратор узнает о новом посте;
изучите log-файл, который хранится на хосте.

Log-файл достаточно объемный, однако, потратив время на его изучение, вы безошибочно вычислите злодея, соотнеся момент его появления на сайте со временем вредоносных изменений, а затем сможете легко его заблокировать.

Также можно ограничить доступ к критически важным директориям. В Joomla к таковым относится папка Libraries.

Сформируйте файл .htaccess и укажите в нем следующие параметры:

Order allow deny

Deny from all

Файл нужно разместить в папке, доступ к которой будет ограничен. После этого по запросу, в котором указано имя сайта и за ним – /Libraries, пользователю будет направлено сообщение «Ошибка 403 disallowed useragent».

Кейс: VT-metall

Узнай как мы снизили стоимость привлечения заявки в 13 раз для металлообрабатывающей компании в Москве

Узнать как

Хостинг недоступен

Нередко ошибка сервера 403 может возникать, если нет доступа к хостингу, который может оказаться заблокирован самим провайдером для конкретного пользователя. Это чаще всего связано с нарушением технических требований или условий hosting-договора. Как правило, перед блокировкой направляется электронное письмо с предупреждением и указанием ее причин, дается время на устранение недостатков. По истечении срока, если нарушения не устранены, происходит блокировка.

Таким образом, в первую очередь нужно проверить свою электронную почту и найти там письмо соответствующего содержания, а затем выполнить указанные в нем требования провайдера. Если такого послания не обнаружилось, то скорее всего причина проблемы кроется в другом.

Отключение плагинов WordPress

Если так и не удалось установить, почему появляется ошибка 403, то существует вероятность проблемы в плагинах WordPress. Они могут быть неработоспособны или несовместимы с теми настройками сайта, которые вы указали.

В этом случае сначала нужно попытаться отключить плагины. Для этого переходим в раздел «Wp-content» и находим в нем папку «Plugins». Переименуйте ее, после этого сайт не сможет обнаружить и подгрузить ранее указанный плагин. Теперь вновь откройте страницу. Если она загрузилась, то проблема крылась именно в plugins. Осталось лишь выяснить, какой именно из них вызвал неполадки. Для этого можно вернуть прежние имена папкам, а затем аналогичным способом отключать каждую отдельно. Когда проблемный плагин будет обнаружен, его нужно переустановить или заменить на другой.

Защита Hotlink

Хотлинкинг предполагает использование одним порталом ресурсов другого посредством ссылок. Выглядит этот так. Например, на сайте 1 размещены какие-то объемные видеоматериалы, которые понравились владельцу ресурса 2. Владелец веб 2 решил разместить их у себя, указав на них ссылки. Пользователь, заходя на сайт 2, видит эти материалы так же, как если бы они были размещены непосредственно на нем. Однако нагрузка на веб 1 и сервер, на котором он размещен, возрастает, сказываясь негативно на его пропускной способности.

Для предотвращения такого положения хозяин ресурса 1 может указать зону рефереров. В этом случае пользователь, пытающийся ретранслировать материалы с портала 1 на сторонние вебы, будет видеть сообщение «Ошибка 403 доступ запрещен» вплоть до того момента, как хозяин сайта 1 отменит ограничения. Исправить ее самостоятельно владелец ресурса 2 не сможет.

Как решить проблему, если вы – пользователь

Часто с ошибкой скачивания 403 сталкиваются не только администраторы сайтов, но и рядовые пользователи. Что делать:

Прежде всего удостоверьтесь, что данные нужного ресурса в Интернете указаны в адресной строке без ошибок.
Если ошибка 403 проявляется на андроиде, попробуйте загрузить страницу с другого устройства. Возможно, причина проблемы непосредственно в вашем гаджете.
Могут быть временные неполадки у провайдера, поэтому, если сообщение об ошибке 403 направлено удаленным сервером, обновите страницу и проверьте, не исчезла ли она.
Выполните очистку кэша и cookies. Для этого нужно зайти в соответствующие настройки браузера, которые могут отличаться и находиться в разных разделах в каждом из них. В нужном меню отметьте файлы кэша и cookies, после чего нажмите «Очистить».
Пользователь может видеть сообщение «403 ошибка на сайте», если для доступа к нему нужно выполнить вход с логином и паролем. Зарегистрируйтесь или войдите под своей учетной записью, и проблема должна исчезнуть.
При выходе в Интернет с телефона ошибка 403 может появляться, если включён режим экономии трафика. Для ее отключения найдите соответствующий раздел в Google Chrome.
Если ничего не помогло, то остается только ждать. Вполне вероятно, что владелец сайта уже знает об ошибке и пытается ее устранить, но для этого требуется определенное время. Выждав пару дней, попробуйте зайти на ресурс снова.

Способ обхода ошибки 403

Ошибку приложения 403 можно преодолеть достаточно легко. Для этого лишь нужно воспользоваться прокси-сервером. В этом случае запрос пользователя будет оправляться не напрямую на целевой сервер, а сначала проходить через промежуточный компьютер, для которого ограничения не установлены. Тот от своего имени получит требуемые данные и передаст их исходному пользователю. Это очень эффективный способ обхода ограничений в Сети, а также надёжный инструмент для того, чтобы сохранить анонимность.

Прокси-серверы работают как в России, так и за границей. Как правило, подобная услуга предоставляется на возмездной основе.

Прокси может использоваться для расширения возможностей связи, на нем основан, в частности, GPRS, который изменяет IP сотового телефона несколько раз за один выход в Интернет. Связано это с тем, что голосовые сообщения обладают приоритетом при передаче по линиям сотовой связи, а остальные данные передаются по свободным каналам. Провайдеры при использовании несимметричного выхода в Интернет также используют прокси, когда запрос направляется по каналу GPRS, а ответный сигнал принимается по спутниковой связи.

Топ-7 прокси-серверов для обхода ошибки 403

Рассмотрим наиболее популярные прокси-серверы. Ниже представлены как резидентные и мобильные решения, так и серверные прокси с доступными тарифами.

AstroProxy

Предоставляет пользователю как серверные, так и резидентные и мобильные прокси. IP у всех изменяется.

Преимущества:

Наглядное управление через веб-интерфейс и сбор статистики.
Изменяемые IP, сводящие к минимуму возможность обнаружения подключения через удалённый сервер.
Огромный выбор прокси, привязанных более чем к 100 странам по всему миру.
Широкий ассортимент тарифных планов, включая безлимитные варианты.
Моментальный доступ ко всему перечню доступных прокси-серверов.
Возможность платежей как традиционными валютами – рублями, долларами, евро, так и многими видами криптовалюты.
Поддержка русского языка.
Тестовый период, в течение которого возможности сервиса можно опробовать бесплатно.

Недостатки:

Имеется перекос в сторону прокси, привязанных к определенным регионам.
Невысокий дисконт при использовании значительных объёмов переданных данных.

Особенности AstroProxy:

Пользователю предоставляется порт, с которым связаны однотипные прокси. Для каждого из них в полном объеме поддерживается HTTP(S) и SOCKS, которые можно использовать параллельно друг с другом. Данные с каждого порта могут быть моментально активированы через VPN.
Оплачивается трафик только в одном направлении – либо входящий, либо исходящий, в зависимости от того, на какой из них приходится наибольшая часть данных.
Если вы приводите новых пользователей, то вам предоставляется на счет до 10 % от каждого сделанного ими платежа, в то время как у большинства иных провайдеров бонус зачисляется только с первой такой суммы.

Oxylabs

На данном сервисе можно воспользоваться всеми тремя видами proxy – мобильными, динамическими и приватными. Доступны и shared, и частные прокси.

Oxylabs

Преимущества:

Самое большое количество прокси в мире – более 100 млн.
Поддержка HTTP(S) и SOCKS5;
Высокая скорость передачи данных.
К пользователю прикрепляется персональный менеджер.
Изменение прокси как вручную, так и в автоматическом режиме.
Семь дней бесплатного использования для оценки возможностей, рефанд в течение трех дней.

Недостатки:

Дороговизна (от $ 100 для shared, от $ 300 для резидентных прокси и от $ 500 — для мобильных proxy);
Нет поддержки русского языка.

Особенности Oxylabs:

Целевая аудитория – крупные бизнес-компании. Сервис относит себя к премиальному сегменту, предоставляя пользователям широкий набор FPI инструментов из поисковых сайтов, (в частности – SERP Scraper), с онлайн-магазинов (E-Commerce Scraper API), обычных сайтов (Web Scraper API).
Официальный плагин для Chrome, который дает возможность использовать весь спектр прокси.
Имеются резидентные и мобильные proxy в широком перечне государств.

Storm Proxies

К услугам пользователей – резидентные прокси с изменяемым IP, а также серверные, как приватные, так и shared.

Преимущества:

Тарифы, предоставляющие неограниченный трафик.
Доступность тарифов (от $ 39/месяц за выделенные динамические прокси).
Не требуется логин и пароль.
Отдельные прокси для сбора данных с сайтов по продаже билетов и со сникер-ботами.

Недостатки:

Ограничение по частоте изменения IP (не чаще одного раза в три минуты в ручном режиме и не чаще одного раза в 15 минут в автоматическом).
Ограниченный перечень IP (чуть более 200 000).
Не поддерживается протокол SOCKS.
Доступ без логина и пароля снижает безопасность.

Особенности Storm Proxies:

Целевая аудитория – частные пользователи и низкобюджетные стартапы. Может использоваться как основа для запуска сникер- и тикет-ботов. Для трафик-ботов могут использоваться также изменяемые IP. Хорошо подходит для SEO-парсинга и операций с использованием скрейперов.
Удобство для начинающих пользователей прокси, выражающееся в простом интерфейсе и ограниченных возможностях настройки.

SOAX

Доступны мобильные proxy и резидентные прокси с изменяемым IP-адресом.

SOAX

Преимущества:

Надежность соединения.
Доступна функция таргетинга не только по государству, но и по городам и ASN (более 100 стран).
Оперативная поддержка пользователей.
Пробный период с минимальной оплатой – за 1,99 долларов можно получить 100 МБ данных.
Широкие опции для изменения IP (sticky-сессия продолжительностью 90–600 секунд, длительность может быть увеличена).
Поддержка протоколов HTTP(S) и SOCKS5.
Доступная цена, не превышающая предложения конкурентов (99 долларов за мобильные и резидентные прокси).

Недостатки:

Количество портов для доступа HTTP(S) и SOCKS5 ограничено.
Частое падение скорости передачи данных.

Особенности SOAX:

Принцип работы: После входа в панель управления пользователю предоставляется перечень всех доступных прокси, нужные вносятся им в отдельный белый список. Также настраиваются частота и режим изменения IP, геолокация, после чего к порту привязывается перечень этих адресов.
Пользователю в его аккаунте предоставляется список всех действующих прокси и активных ASN.

Smartproxy

Наряду с резидентными прокси, Smartproxy предоставляет пользователю серверные варианты, которые могут быть как с изменяемым IP, так и предоставляться по выделенной линии.

Преимущества:

Быстрота передачи данных, минимальное время отклика на запрос пользователя на любом виде прокси.
Развернутая информация о пользовании сервисом прямо на сайте.
Пользователю предоставляется полный перечень имеющихся резидентных прокси.
Вспомогательное программное обеспечение, предоставляемое безвозмездно.
У резидентных прокси по выделенной линии IP-адрес меняется каждый месяц.
Возможность совершения платежей криптовалютой (используется биткойн).

Недостатки:

Протокол SOCKS5 не работает.
Нет мобильных и ISP прокси;
Все серверные proxy размещены на территории Соединенных Штатов Америки.
Для резидентных прокси не работает ASN-таргетинг.
Пользователи из России и Белоруссии могут совершать платежи только криптовалютой, для использования традиционных валют требуется наличие PayPal или банковской карты, которая зарегистрирована за пределами этих стран.

Особенности Smartproxy:

Имеется собственный безопасный браузер X-Browser, а также плагины для сторонних программ для серфинга в Сети. Предоставляется скрейпер как отдельное приложение (SERP), так и в виде плагина для браузера (Smart Scraper).

Bright Data (ex. Iluminati)

Пользователю предоставляются ISP-прокси, резидентные и мобильные, частные и shared серверные proxy.

Преимущества:

Огромный опыт в предоставлении прокси-услуг. Компания, созданная в Израиле, находится на рынке с 2014 года.
Наряду с прокси, пользователю предоставляется полноценный сервис по сбору сведений.
Имеются все популярные предложения proxy.
Искусственный интеллект подбирает прокси, который наиболее отвечает нуждам пользователя (технология Proxy Waterfall).
Бесперебойная работа сервиса и предоставляемого им proxy-канала.
Наличие русскоязычного интерфейса.

Недостатки:

Дороговизна (за резидентные или мобильные прокси придется выложить не менее $ 500);
Плохо подходит новичкам, так как предполагает наличие навыков программирования и сетевого администрирования.

Особенности Bright Data:

Является полноценным решением для профессионалов, которые, помимо прокси, предлагает также и эффективные решения для скрейпинга, парсинга, настройки изменения IP, возможность расширенного сбора данных. Также отличается безопасностью, которой способствует как собственная технология Data Unblocker, отслеживающая cookies и активность браузера, так и наличие плагина для популярных браузеров.
Предлагается не менее 72 млн прокси всех видов.

NetNut

Предоставляются как shred-прокси для серверов, так и ISP, и резидентные proxy с постоянным и с изменяемым IP-адресом.

NetNut

Преимущества:

Колоссальное количество доступных ISP-прокси – свыше 1 млн.
Предоставляется семь дней бесплатного использования для ознакомления с возможностями сервиса.
Не ограничивается число запросов, которые могут быть направлены в один момент времени.
Резидентные прокси имеют широкий выбор по их географическому размещению.
Бесперебойное соединение и передача данных по резидентным каналам.

Недостатки:

Русскоязычный интерфейс выполнен машинным способом, что значительно искажает значение многих опций для не владеющего английским языком;
Дороговизна с учетом отсутствия поддержки в рамках пакетов некоторых опций, которые в тех же тарифах на других сервисах дополнительно предоставляются пользователю (не менее $ 20 за 20 ГБ трафика, при этом нет поддержки белого списка, Skype и некоторых других возможностей).
Небольшой выбор ISP-прокси, привязанных к странам Азии и Африки.
Геолокация поддерживается только для прокси, IP которых приписаны к Соединённым Штатам Америки.
Неудобные интерфейс, который новичка собьет с толку, и справочник по часто возникающим проблемам.

Особенности NetNut:

Входит в число лидеров по выбору ISP-прокси, привязанных в основном к Европе и Соединенным Штатам Америки.
Имеется API приложение, которое обрабатывает запросы, заменяя proxy, что позволяет повысить продуктивность скрейпинга информации (данная возможность входит в цену наиболее дорогостоящих пакетов).

Скачайте полезный документ по теме:

Чек-лист: Как добиваться своих целей в переговорах с клиентами

Как устранить ошибку 403 в Play Market

Очень часто с ошибкой 403 сталкиваются пользователи Play Market при попытке установки приложения на гаджет. Как правило, проблема устраняется очисткой временных файлов и cookies в меню опций. Также код 403 указывается в ошибке Плей Маркета для пользователей в тех странах, в которых Google заблокирован. В этом случае придется воспользоваться VPN.

Столкнувшись с ошибкой Плей Маркета 403, попробуйте сперва протестировать стабильность соединения или канала Wi-Fi. Затем выключите и снова включите гаджет, проверьте, что свободный объем памяти достаточен для скачивания и установки данных.

Ошибку 403 в Плей Маркете исправить не так сложно. Для этого нужно войти в меню настроек и выполнить следующую последовательность действий:

откройте меню «Приложения» (может также называться «Приложения и уведомления»), найдите пункт «Сведения о приложении»;
кликните по заголовку «Play Маркет», если Android ниже 7 версии, также зайдите в хранилище;
кликните по опции «Стереть данные», на запрос системы о подтверждении действия ответьте утвердительно;
Повторно войдите в Play Market, попытайтесь скачать ранее недоступные данные вновь. Ошибка 403 может появиться и в этот раз, что значит недоступность сервера. В этом случае те же действия нужно вновь выполнить из меню настроек в приложении «Сервисы Google Play».

Как исправить ошибку 403 в Крыму

Спор из-за территориальной принадлежности Крыма повлек отказ многих западных компаний работать на данной территории, включая Google, отключившей для жителей полуострова Play Market, и Apple, заблокировавшей сервис AppStore.

Выручит в этой неприятной ситуации изменение IP-адреса, который эти сервисы будут видеть при обращении к ним пользователя. Для этого используйте VPN. Возможно, для полноценной работы потребуется скачать и установить на свой гаджет файл apk.

Для теста опробуем браузер Opera VPN:

Включите Opera VPN на вашем устройстве и кликните по надписи «Начать работу»
Увидев на дисплее вопрос о разрешении на подключение, отвечаем утвердительно.
После нажатия кнопки «Подключиться» весь исходящий трафик будет обрабатываться серверами Opera, которые размещены в Германии, Канаде, Нидерландах, Сингапуре и США. Приложение автоматически подключается к тому из них, который размещен ближе всего к устройству пользователя. Можно выбрать любой другой, но чем дальше находится сервер, тем сильнее падает скорость передачи данных.
В верхней части телефона должна появиться иконка ключа, что означает активность VPN. Попытайтесь зайти на сайт, который ранее выдавал ошибку 403. Если удалось выполнить вход, то виртуалка работает нормально.

Как обойти ошибку 403 в Netflix

Сервис Netflix официально приостановил работу на территории РФ, но пока не сообщал о полной блокировке. В результате пользователи при попытке войти на сервис видят сообщение nw 6 403. Netflix выдает такую ошибку, поскольку при обращении к сервису в запросе отображается российский IP-адрес. Рассмотрим, как ее исправить.

Устранение ошибки «Нетфликс» nw 6 403 на персональных компьютерах и смартфонах

Неплохим способом решения проблемы будет использование VPN-сервисов. Они позволяют скрыть местонахождение пользователя, предоставляя Netflix данные прокси сервера, через который подключается пользователь. Во многих случаях есть возможность выбрать конкретную локацию IP. Дело в том, что содержание контента, который предоставляется данной стриминговой платформой, даже без учета ограничений различно в зависимости от нахождения устройства, направившего запрос. Поэтому выбор VPN по локации позволит получить полный доступ к содержимому Netflix.

Нужно помнить о ряде факторов, с которыми будет сопряжено устранение на «Нетфликс» ошибки 403 с помощью VPN. Прежде всего это ограниченная скорость данных, которые будут передаваться пользователю, что повлечёт нестабильное воспроизведение видео. Также платформа запрещает использовать средства обхода региональных ограничений, за нарушение этого правила пользователя могут заблокировать. И, наконец, Netflix способен отслеживать подключение пользователя через VPN, после чего сразу происходит обрыв соединения. Таким образом, подобный способ обхода ошибки с кодом nw 6 403 не может гарантировать безотказную работу.

Если вы согласны мириться с этими неудобствами, то вопрос только в выборе подходящего VPN-сервиса. Платные платформы предлагают более широкие возможности и широкий перечень серверов и их типов. Стоит обратить внимание на такие из них, как ExpressVPN, Zenmate, Surfshark и CyberGhost. Зарегистрировавшись на сайте соответствующей площадки, нужно скачать приложение и установить его на телефон или ПК, после чего выполнить подключение к Интернету через VPN.

Проблемы могут возникнуть также с оплатой подписки в Netflix. Для этого в идеале нужен человек, который находится вне территории России и имеет карту зарубежного банка. В противном случае попробуйте воспользоваться VPN, который работает бесплатно. Эффективность невысока, но за неимением лучшего можно использовать и им. Попробуйте сервисы Proton VPN, плагин Windscribe, Browsec и Lantern.

Устранение ошибки 403 на телевизоре

В данном случае ситуация сложнее, чем в случае с ПК или смартфоном. На телевизор не получится установить какое-то стороннее программное обеспечение. Поэтому если ошибка nw 6 403 Netflix появилась на телевизоре, нужно изменить настройки роутера.

Они различны для разных производителей. В Сети можно найти для каждого роутера алгоритм действий, который позволит обойти ошибку eos in ff 403. Также для большинства моделей имеется возможность настроить VPN, в этом вам поможет Интернет.

Статья опубликована: 08.09.2022

Облако тегов

Понравилась статья? Поделитесь:

Источник

The HTTP status code in IIS 7.0 and later versions

Introduction

Log file locations

The HTTP status codes

1xx — Informational

2xx — Success

3xx — Redirection

4xx — Client error

5xx — Server error

Common HTTP status codes and the causes

HTTP substatus codes added in IIS 8.0

HTTP substatus codes added in ARR 3.0.1916

References

1xx informational response

2xx success

3xx redirection

4xx client errors

5xx server errors

Unofficial codes

Internet Information Services

nginx

Cloudflare

AWS Elastic Load Balancer

Caching warning codes (obsoleted)

See also

Explanatory notes

References

External links

Brief and Terse

Detailed and In-Depth

TL;DR

Practical Examples

RFC (2616 Section 10)

401 Unauthorized (10.4.2)

403 Forbidden (10.4.4)

Причины появления ошибки 403

Доступ к ресурсу может быть ограничен для пользователя из какой-либо страны

В работе сайта возникли сбои в связи с изменениями, внесёнными в код

Браузер пишет «Ошибка 403», когда пользователь пытается загрузить конкретную страницу

Провоцируем 403 сами

Хостинг недоступен

Отключение плагинов WordPress

Защита Hotlink

Как решить проблему, если вы – пользователь

Способ обхода ошибки 403

Топ-7 прокси-серверов для обхода ошибки 403

AstroProxy

Oxylabs

Storm Proxies

SOAX

Smartproxy

Bright Data (ex. Iluminati)

NetNut

Как устранить ошибку 403 в Play Market

Как исправить ошибку 403 в Крыму

Как обойти ошибку 403 в Netflix

Читайте также: