Diagnose HTTP 403 Forbidden
Identify the rejecting layer before changing permissions or security.
Before you begin
Failing action, address, timestamp and sanitized response.
Use the controls offered by your installed version and account permissions. This guide describes the workflow; it does not grant additional access.
Follow the steps
- Check whether navigation works and only one action fails.
- If the session actually expired, sign in and reopen the form.
- For persistent failures, correlate application and WAF/server logs with the administrator.
- Check authorization, CSRF, ownership and request limits as appropriate.
- Retest after a narrow correction.
Check the result
The original action works and the rejecting cause is known.
If something goes wrong
Do not use chmod 777 or disable all WAF rules/authentication as a generic fix.
Prepare useful details for support