Что такое http error 403 - Исправление ошибок и поиск оптимальных решений проблем

From Wikipedia, the free encyclopedia

HTTP 403 is an HTTP status code meaning access to the requested resource is forbidden. The server understood the request, but will not fulfill it.

Specifications[edit]

HTTP 403 provides a distinct error case from HTTP 401; while HTTP 401 is returned when the client has not authenticated, and implies that a successful response may be returned following valid authentication, HTTP 403 is returned when the client is not permitted access to the resource despite providing authentication such as insufficient permissions of the authenticated account.^[a]

Error 403: «The server understood the request, but is refusing to authorize it.» (RFC 7231)^[1]

Error 401: «The request requires user authentication. The response MUST include a WWW-Authenticate header field (section 14.47) containing a challenge applicable to the requested resource. The client MAY repeat the request with a suitable Authorization header field (section 14.8). If the request already included Authorization credentials, then the 401 response indicates that authorization has been refused for those credentials.» (RFC 2616)^[2]

The Apache web server returns 403 Forbidden in response to requests for URL^[3] paths that corresponded to file system directories when directory listings have been disabled in the server and there is no Directory Index directive to specify an existing file to be returned to the browser. Some administrators configure the Mod proxy extension to Apache to block such requests and this will also return 403 Forbidden. Microsoft IIS responds in the same way when directory list
ings are denied in that server. In WebDAV, the 403 Forbidden response will be returned by the server if the client issued a PROPFIND request but did not also issue the required Depth header or issued a Depth header of infinity.^[3]

Substatus error codes for IIS[edit]

The following nonstandard codes are returned by Microsoft’s Internet Information Services, and are not officially recognized by IANA.

403.1 – Execute access forbidden
403.2 – Read access forbidden
403.3 – Write access forbidden
403.4 – SSL required
403.5 – SSL 128 required
403.6 – IP address rejected
403.7 – Client certificate required
403.8 – Site access denied
403.9 – Too many users
403.10 – Invalid configuration
403.11 – Password change
403.12 – Mapper denied access
403.13 – Client certificate revoked
403.14 – Directory listing denied
403.15 – Client Access Licenses exceeded
403.16 – Client certificate is untrusted or invalid
403.17 – Client certificate has expired or is not yet valid
403.18 – Cannot execute request from that application pool
403.19 – Cannot execute CGIs for the client in this application pool
403.20 – Passport logon failed
403.21 – Source access denied
403.22 – Infinite depth is denied
403.502 – Too many requests from the same client IP; Dynamic IP Restriction limit reached
403.503 – Rejected due to IP address restriction

Notes[edit]

^ See #403 substatus error codes for IIS for possible reasons of why a webserver may refuse to fulfill a request.

References[edit]

^
Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content. IETF. sec. 6.5.3. doi:10.17487/RFC7231. RFC 7231.
^ Nielsen, Henrik; Mogul, Jeffrey; Masinter, Larry M.; Fielding, Roy T.; Gettys, Jim; Leach, Paul J.; Berners-Lee, Tim (June 1999). «RFC 2616 — Hypertext Transfer Protocol — HTTP/1.1». Tools.ietf.org. doi:10.17487/RFC2616. Retrieved 2018-04-09.
^ ^a ^b «HTTP Extensions for Web Distributed Authoring and Versioning (WebDAV)». IETF. June 2007. Archived from the original on March 3, 2016. Retrieved January 12, 2016.

External links[edit]

Apache Module mod_proxy – Forward
Working with SELinux Contexts Labeling files
Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content

Источник

From Wikipedia, the free encyclopedia

HTTP 403 is an HTTP status code meaning access to the requested resource is forbidden. The server understood the request, but will not fulfill it.

Specifications[edit]

Error 403: «The server understood the request, but is refusing to authorize it.» (RFC 7231)^[1]

Substatus error codes for IIS[edit]

The following nonstandard codes are returned by Microsoft’s Internet Information Services, and are not officially recognized by IANA.

403.1 – Execute access forbidden
403.2 – Read access forbidden
403.3 – Write access forbidden
403.4 – SSL required
403.5 – SSL 128 required
403.6 – IP address rejected
403.7 – Client certificate required
403.8 – Site access denied
403.9 – Too many users
403.10 – Invalid configuration
403.11 – Password change
403.12 – Mapper denied access
403.13 – Client certificate revoked
403.14 – Directory listing denied
403.15 – Client Access Licenses exceeded
403.16 – Client certificate is untrusted or invalid
403.17 – Client certificate has expired or is not yet valid
403.18 – Cannot execute request from that application pool
403.19 – Cannot execute CGIs for the client in this application pool
403.20 – Passport logon failed
403.21 – Source access denied
403.22 – Infinite depth is denied
403.502 – Too many requests from the same client IP; Dynamic IP Restriction limit reached
403.503 – Rejected due to IP address restriction

Notes[edit]

^ See #403 substatus error codes for IIS for possible reasons of why a webserver may refuse to fulfill a request.

References[edit]

^
Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content. IETF. sec. 6.5.3. doi:10.17487/RFC7231. RFC 7231.
^ Nielsen, Henrik; Mogul, Jeffrey; Masinter, Larry M.; Fielding, Roy T.; Gettys, Jim; Leach, Paul J.; Berners-Lee, Tim (June 1999). «RFC 2616 — Hypertext Transfer Protocol — HTTP/1.1». Tools.ietf.org. doi:10.17487/RFC2616. Retrieved 2018-04-09.
^ ^a ^b «HTTP Extensions for Web Distributed Authoring and Versioning (WebDAV)». IETF. June 2007. Archived from the original on March 3, 2016. Retrieved January 12, 2016.

External links[edit]

Apache Module mod_proxy – Forward
Working with SELinux Contexts Labeling files
Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content

Источник

Все мы, путешествуя по просторам интернета, натыкаемся на различные ошибки при загрузке сайтов. Одна из них, кстати, достаточно часто встречается – я говорю об ошибке сервера 403 Forbidden Error. Сегодня я рассмотрю причины ее возникновения и способы устранения со стороны владельца сайта и его пользователя.

Что означает ошибка 403 и почему она появляется

Ошибка сервера 403 Forbidden означает ограничение или отсутствие доступа к материалу на странице, которую вы пытаетесь загрузить. Причин ее появления может быть несколько, и вот некоторые из них:

Формат индексного файла неверен.
Некорректно выставленные права на папку/файл.
Файлы были загружены в неправильную папку.

Комьюнити теперь в Телеграм

Подпишитесь и будьте в курсе последних IT-новостей

Исправление ошибки сервера 403 Forbidden

Чтобы исправить ошибку сервера 403 Forbidden, обязательно нужен доступ к панели управления вашего хостинга. Все описанные ниже шаги применимы к любой CMS, но примеры будут показаны на основе WordPress.

Проверка индексного файла

Сначала я проверю, правильно ли назван индексный файл. Все символы в его имени должны быть в нижнем регистре. Если хотя бы один символ набран заглавной буквой, возникнет ошибка 403 Forbidden. Но это больше относится к ОС Linux, которой небезразличен регистр.

Еще не стоит забывать, что индексный файл может быть нескольких форматов, в зависимости от конфигураций сайта: index.html, index.htm, или index.php. Кроме того, он должен храниться в папке public_html вашего сайта. Файл может затеряться в другой директории только в том случае, если вы переносили свой сайт.

Любое изменение в папке или файле фиксируется. Чтобы узнать, не стала ли ошибка итогом деятельности злоумышленников, просто проверьте графу «Дата изменения».

Настройка прав доступа

Ошибка 403 Forbidden появляется еще тогда, когда для папки, в которой расположен искомый файл, неправильно установлены права доступа. На все директории должны быть установлены права на владельца. Но есть другие две категории:

группы пользователей, в числе которых есть и владелец;
остальные, которые заходят на ваш сайт.

На директории можно устанавливать право на чтение, запись и исполнение.

Так, по умолчанию на все папки должно быть право исполнения для владельца. Изменить их можно через панель управления TimeWeb. Для начала я зайду в раздел «Файловый менеджер», перейду к нужной папке и выделю ее. Далее жму на пункт меню «Файл», «Права доступа».

Откроется новое окно, где я могу отрегулировать права как для владельца, так и для всех остальных.

Отключение плагинов WordPress

Если даже после всех вышеперечисленных действий ошибка не исчезла, вполне допустимо, что влияние на работу сайта оказано со стороны некоторых плагинов WordPress. Быть может они повреждены или несовместимы с конфигурациями вашего сайта.

Для решения подобной проблемы необходимо просто отключить их. Но сначала надо найти папку с плагинами. Открываю папку своего сайта, перехожу в раздел «wp-content» и нахожу в нем директорию «plugins». Переименовываю папку – выделяю ее, жму на меню «Файл» и выбираю соответствующий пункт. Название можно дать вот такое: «plugins-disable». Данное действие отключит все установленные плагины.

Теперь нужно попробовать вновь загрузить страницу. Если проблема исчезла, значит, какой-то конкретный плагин отвечает за появление ошибки с кодом 403.

Но что делать, если у вас плагин не один, а какой из них влияет на работу сайта – неизвестно? Тогда можно вернуть все как было и провести подобные действия с папками для определенных плагинов. Таким образом, они будут отключаться по отдельности. И при этом каждый раз надо перезагружать страницу и смотреть, как работает сайт. Как только «виновник торжества» найден, следует переустановить его, удалить или найти альтернативу.

Как решить проблему, если вы – пользователь

Выше я рассмотрела способы устранения ошибки 403 Forbidden для владельцев сайта. Теперь же разберу методы исправления в случаях с пользователем.

Сначала надо убедиться, что проблема заключается именно в вашем устройстве. Внимательно проверьте, правильно ли вы ввели URL сайта. Может, в нем есть лишние символы. Или, наоборот, какие-то символы отсутствуют.
Попробуйте загрузить страницу с другого устройства. Если на нем все будет нормально, значит, проблема кроется именно в используемом вами девайсе. Если нет – надо перейти к последнему шагу.
Еще хороший вариант – немного подождать и обновить страницу. Делается это либо кликом по иконке возле адресной строки браузера, либо нажатием на комбинацию Ctrl + F5. Можно и без Ctrl, на ваше усмотрение.
Если ничего из вышеперечисленного не помогло, надо очистить кэш и cookies. Провести такую процедуру можно через настройки браузера. Для этого необходимо открыть историю просмотров, чтобы через нее перейти к инструменту очистки. Эту же утилиту часто можно найти в настройках, в разделе «Конфиденциальность и безопасность». В новом окне нужно отметить пункты с кэшем и cookies и нажать на кнопку для старта очистки.

Ошибка 403 Forbidden возникает и тогда, когда пользователь пытается открыть страницу, для доступа к которой сначала надо осуществить вход в систему. Если у вас есть профиль, просто войдите в него и попробуйте вновь загрузить нужную страницу.
Если вы заходите со смартфона, попробуйте отключить функцию экономии трафика в браузере. Она находится в настройках, в мобильном Google Chrome под нее отведен отдельный раздел.
Последний шаг – подождать. Когда ни один способ не помогает, значит, неполадки возникли именно на сайте. Возможно, его владелец уже ищет способы решения проблемы и приступает к их исполнению, но это может занять какое-то время. Пользователям остается только дождаться, когда все работы будут завершены.

Еще одна допустимая причина появления ошибки сервера 403 – доступ к сайту запрещен для определенного региона или страны, в которой вы находитесь. Бывает и такое, что сайт доступен для использования только в одной стране. Если вы используете VPN, попробуйте отключить его и перезагрузите страницу. Вдруг получится все исправить.

Если ничего из вышеперечисленного не сработало, рекомендуется обратиться к владельцу сайта. Есть вероятность, что никто не знает о возникшей проблеме, и только ваше сообщение может изменить ситуацию.

Источник

From Wikipedia, the free encyclopedia

HTTP 403 is an HTTP status code meaning access to the requested resource is forbidden. The server understood the request, but will not fulfill it.

Specifications[edit]

Error 403: «The server understood the request, but is refusing to authorize it.» (RFC 7231)^[1]

Substatus error codes for IIS[edit]

The following nonstandard codes are returned by Microsoft’s Internet Information Services, and are not officially recognized by IANA.

403.1 – Execute access forbidden
403.2 – Read access forbidden
403.3 – Write access forbidden
403.4 – SSL required
403.5 – SSL 128 required
403.6 – IP address rejected
403.7 – Client certificate required
403.8 – Site access denied
403.9 – Too many users
403.10 – Invalid configuration
403.11 – Password change
403.12 – Mapper denied access
403.13 – Client certificate revoked
403.14 – Directory listing denied
403.15 – Client Access Licenses exceeded
403.16 – Client certificate is untrusted or invalid
403.17 – Client certificate has expired or is not yet valid
403.18 – Cannot execute request from that application pool
403.19 – Cannot execute CGIs for the client in this application pool
403.20 – Passport logon failed
403.21 – Source access denied
403.22 – Infinite depth is denied
403.502 – Too many requests from the same client IP; Dynamic IP Restriction limit reached
403.503 – Rejected due to IP address restriction

Notes[edit]

^ See #403 substatus error codes for IIS for possible reasons of why a webserver may refuse to fulfill a request.

References[edit]

^
Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content. IETF. sec. 6.5.3. doi:10.17487/RFC7231. RFC 7231.
^ Nielsen, Henrik; Mogul, Jeffrey; Masinter, Larry M.; Fielding, Roy T.; Gettys, Jim; Leach, Paul J.; Berners-Lee, Tim (June 1999). «RFC 2616 — Hypertext Transfer Protocol — HTTP/1.1». Tools.ietf.org. doi:10.17487/RFC2616. Retrieved 2018-04-09.
^ ^a ^b «HTTP Extensions for Web Distributed Authoring and Versioning (WebDAV)». IETF. June 2007. Archived from the original on March 3, 2016. Retrieved January 12, 2016.

External links[edit]

Apache Module mod_proxy – Forward
Working with SELinux Contexts Labeling files
Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content

Источник

Imagine this – you’ve recently created a new website to host your content, and you’re excited to see it go live. You can’t wait to dive into SEO and begin ranking for keywords and attracting an audience to your brand.

But then a friend emails you and says, «Hey, is there a reason I see this when I click on your website? «

Image Source

Undoubtedly, a «403 Forbidden» message is cause for immediate concern. How many potential viewers are you losing, as they come across your website to find this message?

Fortunately, there are a few quick-and-easy solutions to a 403 error. Here, we’ll explain the top three, so you can get your site up and running.

A 403 Forbidden error is an HTTP status code sent to users by an HTTP server when a user tries to access a restricted URL. It means the page you were trying to reach is forbidden for one of two reasons: Either there is a removal or restriction of access permissions from the client-side, or there’s an accidental misconfiguration of the web server.

What you’ll typically see when you land on a page with a 403 forbidden error is something like this: «You don’t have authorization to view this page – HTTP Error 403.»

It can also have slightly different wording, like the example below.

Image Source

Wondering about the difference between a 403 and 404 error? Here it is: A 404 error happens when you access a page that no longer exists or cannot be found. A 403 error, on the other hand, indicates that your access has been denied due to incorrect credentials.

An easy way to remember it: 403 says «access denied» while 404 says «We can’t find what you asked for.»

What causes a 403 error?

There are a few reasons why you may see a 403 forbidden error. Here are the most common:

Permission or ownership error – Permissions are represented by codes, which indicate what each type of user can do. If you have the incorrect code associated with a file or directory then your users may run into a 403 error.

Wrong file or folder location – When uploading content to your site, you may have added it to the wrong directory, which is not accessible to your end-users.

No index page – If your homepage doesn’t have an index page, it will not display correctly on a browser.
Misconfigured WordPress plugin – A plugin may be blocking IP addresses to avoid malware, causing the 403 forbidden error.

Now that you know the causes, let’s address how to fix them.

How to Fix 403 Errors

1. Set the correct file permissions.

If you’ve configured your web server, you’ll want to add the server to the www-data group, and set ownership of /var/www to the www-data user and www-data group.

Then, make sure your directories are set to 755, your files are set to 644, and your dynamic content is set to 700. This determines which user types (owner, group, everyone) can read, write, and execute.

2. Make sure you have an index page.

Your website’s home page must be called index.html or index.php – if it’s not, you should rename the homepage to include one of those URL names.

Alternatively, you can upload an index page to your httpdocs directory and then set up a redirect on the index page to your real homepage.

3. Upload your website content to the correct directory on your server.

You might see a 403 forbidden message if you haven’t correctly uploaded your content to the directory on your server.

There are several different FTP clients you might’ve chosen to host your domain — let’s say you chose FileZilla, which is free and available for Windows, Mac, and Linux.

To publish your content online, you’ll need to put your files into the public/htdocs directory.

Note: If you’re using FileZilla, these instructions will vary if you use a different FTP client. Once you’ve dragged and dropped your files into the directory, you should search your website’s URL to double-check they now appear online.

If you’re in your FTP server and don’t see the httpdocs directory, you can create a file within the directory with this title, which could also solve the issue.

4. Deactivate and reactivate your plugins.

If you suspect one of your plugins is responsible for the 403 forbidden error, temporarily deactivate all of your plugins.

You may have noticed the error shortly after installing a plugin. If so, start with that one and work your way down from the most recent installation to the oldest.

Then, one by one, activate each plugin and refresh the page to determine which plugin is causing the error.

As you can see, 403 errors can typically be resolved in just a few easy steps. It’s just about knowing where to look.

Источник

Receiving any error code while online can be a frustrating experience. While we’ve become accustomed to 404 Not Found pages, even to the extent that it’s become common to see cute placeholder pages to entertain us whenever we get lost, one of the more puzzling errors is the 403: Forbidden response.

What does it mean?

Simply put: the server has determined that you are not allowed access to the thing you’ve requested.

According to RFC 7231:

The 403 (Forbidden) status code indicates that the server understood the request but refuses to authorize it…If authentication credentials were provided in the request, the server considers them insufficient to grant access.

The 403 response belongs to the 4xx range of HTTP responses: Client errors. This means either you, or your browser, did something wrong.

If you encounter this it usually means that you have already authenticated yourself with the server, i.e. you’ve logged in, but the resource you have requested expects someone with higher privileges.

Most commonly, you might be logged in as a standard user, but you are attempting to access an admin page.

How do you fix it?

As a user without access to the server, you really only have a few options:

Authenticate yourself with a more appropriate account

Again, according to RFC 7231:

If authentication credentials were provided in the request, the server considers them insufficient to grant access. The client SHOULD NOT automatically repeat the request with the same credentials. The client MAY repeat the request with new or different credentials.

This is the only one that gives you any immediate power to rectify the issue.

If you have multiple accounts for a site and you are attempting to do something you can usually do, but this time are forbidden from doing, this is the option you should try. Log in with your other account.

You may find that this option also requires clearing your cache or cookies, just in case logging in as another user doesn’t sufficiently flush the previous authentication tokens. But this is usually unnecessary.

As a desperate move, you could also try disabling browser extensions that might be interfering with your use of the site. However, this is unlikely, since a 403 implies you are authenticated, but not authorized.

Notify the site owner that a 403 is being returned when you’d expect otherwise

If you fully expect that you should be able to access the resource in question, but you are still seeing this error, it is wise to let the team behind the site know — this could be an error on their part.

Once more from RFC 7231:

However, a request might be forbidden for reasons unrelated to the credentials.

A common cause for this happening unintentionally can be that a server uses allow- or deny-lists for particular IP addresses or geographical regions.

They might have a good reason for blocking your access outside of their strictly defined parameters, but it could also just be an oversight.

Give up.

Maybe you just aren’t supposed to be able to access that resource. It happens. It’s a big internet and it’s reasonable to expect that there are some areas off limits to you personally.

You could visit http.cat instead while ruminating on why your original request was forbidden.

As a reader of freeCodeCamp News, you are almost certainly not forbidden from following @JacksonBates on Twitter for more tech and programming related content.

Learn to code for free. freeCodeCamp’s open source curriculum has helped more than 40,000 people get jobs as developers. Get started

Источник

Introduction: What is a 403 Error?
Firewall Rules
403 on an Image or File
Caching and Nonces
File Permissions
CDN Issues
Corrupt/Misconfigured .htaccess file
Broken/Missing Plugins
Custom Nginx Config Rules

Introduction: What is a 403 Forbidden Error?

The 403 Forbidden error occurs when a request is made the server cannot allow. This is often due to a firewall ruleset that strictly prohibits this specific request, but other settings such as permissions may prevent access based on user rights.

When 403s occur, your server understands the request that is being made, but is refusing to comply with the request.

That’s about all there is to it. Your request is forbidden.

Error Messaging

On Nginx a 403 looks as follows: 403 Forbidden – nginx

Other variations of a 403 include:

403 – Forbidden: Access is denied
Error 403 – Forbidden
403 – Forbidden Error – You are not allowed to access this address
HTTP Error 403 – Forbidden – You do not have permission to access the document or program you requested
403 Forbidden – Access to this resource on the server is denied

Note

The following are all certainly possibilities for your 403 errors, however, in 90% of cases, 403 errors are caused by a firewall, caching issue, or permissions issue.

1. Firewall Rules

By far the most common reason for 403 errors is that the request you’re making is being blocked for breaking one of the firewall rules.

Unlike most other hosting providers, GridPane equips you with 1-3 different Web Application Firewall (WAF) options depending on your plan: –

6G WAF
7G WAF
ModSecurity

Usually, 403s are a good thing. In most cases, these types of requests are malicious in nature and the firewall blocks those from even reaching your application (WordPress website). However, WordPress is a vast ecosystem of different functionality and false positives can and do occur.

The quickest way to discover if your 403 error is being caused by a WAF is to simply turn it off and try to reproduce the issue. If the 403 no longer occurs, this is a WAF issue.

You can find out the specific reason the request is being blocked by checking the log. This is available directly inside the security tab at the bottom of the settings.

Once you know the cause, you can begin crafting an exclusion that is fairly straightforward, and fully documented in the links above.

Example

Here’s an example of a request that resulted in a 403 error with the 7G WAF:

website.com/wp-admin/admin.php?page=seopress-google-analytics&code=4/0AY0eSoaWlA&scope=https://www.googleapis.com/auth/analytics.readonly

This request broke 2 rules, as detailed by this result in the 7G WAF log:

[17/Nov/2020:15:05:35 +0000] [":bad_querystring_12::bad_request_15:"] 199.199.199.199 yourdomain.com "GET /wp-admin/admin.php?page=seopress-google-analytics&code=4/0AY0e-g44ZrE9024kffJQ2LbRdRxVLOQgAruyU9wAHI1jYFCDaUo10xmwW5rpilPzqNKOSoaWlA&scope=https://www.googleapis.com/auth/analytics.readonly HTTP/1.1" 403 "https://accounts.google.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36"

Using this information we can create a rule to exclude these two results by targeting “page=seopress-google-analytics&code” and adding an exclusion for both errors like so:

set $exclusion_rule_match "";
if ( $args ~* ^page=seopress-google-analytics&code ) {
set $exclusion_rule_match 15;
}
if ($bad_request_7g = $exclusion_rule_match) {
set $7g_drop_bad_request 0;
}

set $exclusion_rule_match "";
if ( $args ~* ^page=seopress-google-analytics&code ) {
set $exclusion_rule_match 12;
}
if ($bad_querystring_7g = $exclusion_rule_match) {
set $7g_drop_bad_query_string 0;
}

Please see the full articles for a complete tutorial.

403 on an Image or File

Following on from the above section, images or files may sometimes return a 403 for a seemingly unknown reason.

These can be difficult to troubleshoot because it’s really not obvious what the cause is, however, this is almost certainly either the 7G firewall.

A couple of examples to illustrate this are images/files that contain either the word “Specialist” or the word “Conference”.

The reason these get flagged are due to the word conference containing “conf” (which is a file name extension), and specialist containing the name of a commonly spammed pharmaceutical.

The quickest solution is to rename the file, or to edit out that specific line or word in the firewall. Our documentation has details how to do this here:

Using the GridPane 7G Web Application Firewall

2. Caching and Nonces

The second most common issue outside of a firewall rule being is broken is where caching is interfering with a form (such as a contact form, or payment gateway form). Here, the form uses what’s called a “nonce” (a security token which is a number or random string used only once), which exists for a set period of time (12 hours is common) after which it changes to something new. Once change occurs, the cache may serve the outdated nonce and this results in an error.

If you have a form or any functionality that makes use of a nonce, these can break and return 403 errors if the cache isn’t cleared once the nonce expires.

In many cases, nonces last 12-24 hours. For example, the Gravity forms payment gateway has a 12-hour nonce and can result in 403 errors if cached for over 12 hours.

If clearing the cache allows your functionality to begin operating correctly again, this is a caching issue.

Plugins we know of that may experience cache related issues are:

Gravity Forms Payments
Divi Forms
Caldera Forms

In these cases, there are a couple of different solutions.

Solution 1. Exclude the page from the cache

If you exclude the page from the cache, the cache will not interfere with the nonce and all forms will operate as normal.

Please see the following guide on how to exclude a page from your website’s cache (Nginx only):

Exclude a page from server caching

Solution 2. Reduce Cache TTL

If you’re using Redis Page Caching, the default TTL is 30 days. If you’re experiencing nonce related form failures, you can reduce the cache time to avoid these in the future.

This requires running a single GP-CLI command. To do so, you will need to SSH into your server. Please see the following guides to get started:

The command for altering the default caching TTL is as follows:

gp stack nginx redis -site-cache-valid {accepted.value} {site.url}

Run the following command to reduce cache time to 6 hours (replacing site.url with your domain name):

gp stack nginx redis -site-cache-valid 21600 site.url

The time length has to be entered in seconds. In this case, 6 hours = 21600 seconds.

For 10 hours, run the following:

gp stack nginx redis -site-cache-valid 36000 site.url

For more details, please see this Redis Page caching section in the Configure Nginx article:

Set caching expiry time for all successful requests going into Redis SRCache page cache

3. Permissions

403 errors can also be caused by incorrect permissions settings. This can sometimes occur when migrating a website over to GridPane.

Fortunately, we have a quick fix self-help tool that can help reset your website to the correct permissions very quickly and with minimal fuss. To fix your websites permissions, please see this article:

Self Help Tools: Reset Application File Permissions

4. CDN Issues

If the 403 forbidden errors you’re experiencing are specific to your assets (images, CSS, and JS files), and you’re using a delivery network (CDN) for your website, try temporarily disabling this service to see if this is at the root of your issue.

If it isn’t, this is likely firewall related, possibly due to 7G Bad Bot rule #5.

5. Corrupt/Misconfigured .htaccess File

Nginx doesn’t use .htaccess, so this error is OpenLiteSpeed specific for GridPane hosted websites.

This is a very powerful file, and if corrupted or misconfigured, this could result in a 403 error for your website.

Fortunately, GridPane keeps a backup copy that you can use in the case of an emergency:

You can get your website back up and running by replacing the current .htaccess file with the contents of the .htaccess.save file.

This is easier done over SFTP. To connect to your server over SFTP, please see either one of the following articles:

Connect to a GridPane Server by SFTP as System User

Connect to a GridPane Server by SFTP as Root user

Step 1

Once connected, first save a copy of the .htaccess.save file to your computer.

Step 2

Next, rename the corrupt .htaccess file to .htaccess.bad

Step 3

Next, rename .htaccess.save to .htaccess and then check your website.

Step 4

You can now re-upload the .htaccess.save to your server again for safekeeping, and delete the .htaccess.bad file.

6. Broken/Missing Plugin Files

If none of the above is the cause for your 403 error, then this could be the work of a broken or missing plugin file.

To check, connect to your server over SFTP (see the links in part 5 above to get started) and rename the plugins folder (located at site.url/htdocs/wp-content/plugins) to plugins-off.

Next, check your website and see if the 403 error is occurring. If not, then you know the root cause is one of the plugins on your website.

Rename the plugins-off directory back to plugins, and then do the same for each of your individual plugin folders, renaming them one by one until you find the one responsible.

7. Custom Nginx Configurations

Sometimes plugin authors can be rather careless with their Nginx recommendations, documenting broad Nginx rules that can result in unexpected/undesirable behavior such as blocking specific types of files altogether, or blocking them when not logged into the website.

You may have added custom configuration rules to Nginx via .conf files in your /var/www/site.url/nginx directory.

For example:

/var/www/example.com/nginx/ithemes-security-main-context.conf

Custom configurations that affect ALL websites on the server may also have been added in these directories:

/etc/nginx/extra.d/

/etc/nginx/conf.d/

Be sure to check this directory for any Nginx configuration files that you or your team members may have added (be sure to ask them so you know what to look for), and review them for code that could prevent access to page or file that your getting your 403 forbidden error.

Источник

Specifications[edit]

Substatus error codes for IIS[edit]

See also[edit]

Notes[edit]

References[edit]

External links[edit]

Specifications[edit]

Substatus error codes for IIS[edit]

See also[edit]

Notes[edit]

References[edit]

External links[edit]

Что означает ошибка 403 и почему она появляется

Исправление ошибки сервера 403 Forbidden

Проверка индексного файла

Настройка прав доступа

Отключение плагинов WordPress

Читайте также

Как решить проблему, если вы – пользователь

Specifications[edit]

Substatus error codes for IIS[edit]

See also[edit]

Notes[edit]

References[edit]

External links[edit]

What causes a 403 error?

How to Fix 403 Errors

1. Set the correct file permissions.

2. Make sure you have an index page.

3. Upload your website content to the correct directory on your server.

4. Deactivate and reactivate your plugins.

What does it mean?

How do you fix it?

Authenticate yourself with a more appropriate account

Notify the site owner that a 403 is being returned when you’d expect otherwise

Give up.

Table of Contents

Introduction: What is a 403 Forbidden Error?

Error Messaging

Note

1. Firewall Rules

Example

403 on an Image or File

2. Caching and Nonces

Solution 1. Exclude the page from the cache

Solution 2. Reduce Cache TTL

3. Permissions

4. CDN Issues

5. Corrupt/Misconfigured .htaccess File

Step 1

Step 2

Step 3

Step 4

6. Broken/Missing Plugin Files

7. Custom Nginx Configurations