Troubleshoot 403 errors
Updated
❗
Forbidden.
A 403 Forbidden means the server understood the request and refused it. On fortrabbit the usual causes are a folder without an index file, a wrong root path or an access rule.
Common causes
| Cause | Check |
|---|---|
No code deployed, or no index.php or index.html in the root path | Apache does not list folder contents, so an empty root path answers 403. Look into the folder with SSH or SFTP |
| Wrong root path | The root path must point to the folder with index.php, such as public or web |
| An access rule | A Require, Deny or RewriteRule … [F] line in .htaccess, see block IPs |
| A protected file | Apache never serves .ht* and .user.ini files |
| The incoming firewall | With the incoming firewall (WAF) on, it blocks requests that match its rules, which can include a software installer |
| File permissions | The files must be readable for their owner. SSH, SFTP and PHP all run as the same user, so chmod -R u+rwX www fixes a file that a tool set to 000 |
A request without valid credentials for a password-protected area gets a 401, not a 403. See password protection.
Apache error log
The Apache error log in the logs names the cause:
AH01630: an access rule denied the requestAH01276 Cannot serve directory: no index file in the folder
See Apache error codes for the full list.