403 forbidden error, 401 and 500 internal server error explained

The short answer

A 403 forbidden error means the server understood the request but refuses to allow it. A 401 means the visitor has not proved who they are. A 500 internal server error means something failed on the server itself. 401 and 403 are about access; 500 is about a fault, usually in code, settings or resources.

What the three numbers mean

Every time a browser asks a server for a page, the server replies with a three-digit status code. Codes starting with 4 mean the request could not be completed because of something about the request. Codes starting with 5 mean the server failed while handling a request that was otherwise fine.

These descriptions follow the web standards documentation published by Mozilla. Codes are a guide, not a diagnosis. Your site can show a 403 page for a reason that has nothing to do with the usual one, so treat the code as the first clue.

What does a 403 forbidden error mean?

A 403 forbidden error means the server received the request, understood it, and chose not to allow it. The server may well know who the visitor is. Signing in again does not help, because the problem is that this visitor is not permitted to see this content.

Common causes on a business website:

• File or folder permissions on the server are set so that the web server cannot read them.
• A security rule, firewall or plugin has blocked the visitor's address, region or browser.
• A directory has no index page and the server is set not to list its contents.
• An access rule in the server configuration denies the request.
• A member-only or staff-only page is being visited by someone without the right role.
• A hosting provider has suspended the account.

Some servers deliberately return a 404 Not Found instead of a 403 so that they do not reveal that a private page exists. If a page you know exists reports as not found, a permissions rule could be the reason.

What is the difference between 401 and 403?

The difference is whether the server knows who you are.

A 401 means unauthenticated. The server needs the visitor to prove who they are, and either no credentials were sent or they were wrong. Logging in correctly can solve it. Despite the word Unauthorized in its name, the code is about identity, not about permission.

A 403 means the server knows the visitor, or has decided no identity will help, and refuses anyway. Logging in again changes nothing, because the problem is permission, not identity.

A practical way to remember it: 401 says, who are you? 403 says, I know, and the answer is no.

For a business owner, the useful consequence is who to ask. A 401 on a staff page usually means a login problem and points to account settings. A 403 usually points to roles, server permissions or a security rule. Our guide to website user roles and permissions covers the role side. Similar problems on a members area often come from a missing or expired login cookie, which our note on cookies and browser storage explains.

How to fix a 403 as a site owner

Work from the simplest cause to the hardest.

1. Reload the page and try another browser or device. This rules out a one-off glitch or a local block.
2. Check the address. A missing file name or a mistyped folder can trigger a 403 on servers that do not list directories.
3. Clear cookies for the site and sign in again if the page is private.
4. Check whether the problem affects everyone or only some people. If only one region or network is blocked, a firewall rule is likely.
5. Look at security plugins and firewall logs for a blocked request.
6. Ask your host or developer to check file and folder permissions and any access rules in the server configuration.
7. Contact your host if nothing else explains it. A suspended account or a server-level rule may be the cause.

Do not change permissions to wide open settings as a quick fix. That can expose files that should stay private. If you are unsure, hand the job to someone who knows the server.

What does a 500 internal server error mean?

A 500 internal server error is a catch-all. The server encountered a condition it did not expect and could not complete the request. The code does not say what went wrong. Only the server's own records can tell you that.

Typical causes:

• A coding error in a theme, plugin or custom script.
• A recent update that is not compatible with something else on the site.
• A damaged or incorrect server configuration file.
• The server running out of memory or processing time.
• A database that is unreachable or has an error.
• A problem at the hosting provider.

A 500 that appears right after a change, such as a plugin update or a new setting, usually points straight at that change. A 500 that appears at busy times may be a sign that hosting resources are too small. Our overview of checking and improving website speed explains how a struggling server shows up in tests before it fails outright.

How do I find the cause of a 500 error?

1. Think about what changed. Note the last update, new plugin, edit or setting before the error began.
2. Undo that change if you can. Deactivate the plugin, switch back to the previous theme or restore the setting.
3. Open the server error log. Most hosting control panels have a logs section. The last few entries usually name the file and the line where the failure happened.
4. Turn on error logging in your content system if it has a debug option, and switch it off again afterwards.
5. Check that the server has enough memory and that the database is running.
6. Restore from a recent backup if you cannot find the cause and the site is losing business.
7. Contact your host with the time of the first error and the log entries.

The log is the answer in almost every case, which is why it is worth knowing where to find it. If you use a content management system you did not build, our guide to what a CMS is and how to choose one explains how updates and plugins fit together, and why they are the usual suspects.

Make your error pages helpful

Visitors who meet an error should still know what to do next. A good error page uses the site design, says in plain words what happened, and offers a way forward: a link to the home page, a search box and a contact route.

• For a 403, say the page is not available to this account, and tell people where to sign in or ask for access.
• For a 401, send people to the login form and bring them back to the page afterwards.
• For a 500, apologise briefly, say it is being looked at and suggest trying again shortly.

Never display technical details such as file paths or database messages to visitors. They help attackers, and they frighten customers. Keep those in the server log.

Also check that the server really returns the right code. A friendly page that returns a normal success code confuses search engines. Ask your developer to confirm the code that is sent along with each error page.

When errors point to a bigger problem

A one-off error is normal. A repeating one is a signal. Repeated 403 errors across many pages may mean a security rule is too strict. Repeated 500 errors suggest outdated software, poor-quality plugins or hosting that has been outgrown.

Monitor for these. An uptime service can alert you when pages fail. A weekly look at the logs often catches trouble early. Also know who owns the accounts you would need to fix it: hosting, domain and code. Our guide to who should own your domain, hosting and code explains why that matters on a bad day.

Some sites that allow public input have extra exposure to blocked requests and spam clean-up. Our note on blog comments covers that trade-off. For help diagnosing repeated server errors or rebuilding on a steadier foundation, see website development. Also check that your secure certificate is valid, since certificate faults produce their own warnings. Our guide to HTTPS and SSL certificates explains them.

Related guides

• Website development
• How to check and improve website speed
• Https and ssl certificates explained
• Cms what it is and how to choose
• Blog Comments: Should Your Business Site Allow Them?
• Website Ownership: Who Owns Your Domain, Hosting, Code

Questions and answers

What does a 403 error mean?

A 403 forbidden error means the server understood your request but refuses to allow it. Common causes are file permissions, a security rule, a blocked address or a page restricted to certain users. Signing in again usually does not help.

What is the difference between 401 and 403?

A 401 means the server needs you to prove who you are, and logging in correctly may fix it. A 403 means the server has decided you may not have the content, and a new login does not change that.

How do I find the cause of a 500 error?

Think about what changed just before it began, such as a plugin update, and undo it. Then read the server error log, which usually names the failing file. If the cause is unclear, restore a recent backup and contact your host.

Will 403 or 500 errors hurt my search visibility?

Occasional errors do not. Pages that return errors for a long time can drop out of search results, because search engines cannot read them. Fix repeating errors quickly and check Search Console for crawl problems.

Can I fix a 500 error myself?

Often yes, if it follows a change you can undo. If you cannot find the cause in the log, or the site holds important data, ask your host or developer rather than guessing.