What it means
The request was valid, the resource may exist, but the server refuses to serve it — because of IP blocking, a firewall rule, a bot filter, geolocation or permissions. For a crawler, a 403 is a hard stop: the page content is never seen.
Why it matters for SEO
- Search engine crawlers receiving 403 will drop the URL from the index — intentional for private areas, catastrophic when a WAF rule accidentally blocks Googlebot.
- 403s on previously indexed URLs usually surface as coverage errors in Search Console: 'Server error (403)' or excluded pages.
- Bot protection that challenges crawlers with 403 instead of serving content is one of the most common ways sites lose rankings after a security appliance is installed.
How to diagnose it
Compare what a real user sees with what a crawler sees. Fetch the URL with different user agents, from different IPs, with and without cookies. If Googlebot gets 403 while users get 200, verify the blocking rule and use Search Console's URL inspection to confirm what Google receives.
Crawl with an honest user agent. SpiderHead keeps its crawler identity configurable per scan so you can reproduce what a search bot receives — never to misrepresent yourself as Googlebot.
FAQ
Is a 403 bad for SEO?
Only where it is not intentional. Deliberately blocking private or admin URLs is correct. Accidentally serving 403 to search crawlers on public content removes those pages from the index.
How is 403 different from 401?
401 Unauthorized means authentication is required and missing — logging in could help. 403 means the server refuses this client regardless of credentials.