Free report
Menu Close

Blocked due to access forbidden (403): what it means and how to fix it

'Blocked due to access forbidden (403)' means the server refused to give Google the page. The page may load perfectly for you. The refusal comes from the server or from a security layer in front of it, and it is usually aimed at crawlers in general, with Google caught by accident. The related 401 status means the page asked for a login.

Updated

This guide, surveyed at release eab6db0 on 19 October 2026: words per section.

Each sounding opens its section

  1. 01 What the two statuses mean 46 words
  2. 02 Where the block usually sits 81 words
  3. 03 Confirm it 38 words
  4. 04 Lift it 80 words
  5. 05 After the fix 32 words
  6. 06 Questions people ask 118 words
  7. 07 Free competitor gap report 100 words
  8. 08 More in this series 239 words
Words
734
Site 366–1,117 · median 749.5
Sections (H2)
8
Site 3–14 · median 9
Internal links
29
Site 1–36 · median 19
File
71.5 kB
HTML, uncompressed · of 83.6 kB budget · 0 scripts

Sheet

010 of 126

Release eab6db0

Standard 49 · 101 checks

What the two statuses mean

Google’s Page indexing report describes them briefly. For 401: the page was blocked to Googlebot by a request for authorisation. For 403: the server did not grant access. In both cases Google never saw the page, so it was not indexed.

Where the block usually sits

A page that loads for visitors and refuses Google is being filtered somewhere between the two.

  • A security or firewall service in front of the site, with bot protection switched on.
  • A security plugin with a rule against crawlers or against certain countries.
  • The hosting company’s own protection, especially on cheap shared hosting.
  • A rule in the server’s configuration left from an earlier attack.
  • A password or “coming soon” mode still protecting part of the site.

Confirm it

Run the address through URL Inspection’s live test. If it reports that the page cannot be fetched, the block is still there. The server’s access log shows the refused requests, with the name the crawler gave.

Lift it

Let Google’s crawler through at whichever layer is refusing it.

  1. In the firewall or security service, allow verified search engine crawlers. Most have a setting for exactly this.
  2. In a security plugin, check the blocked list and the country rules.
  3. Ask the host whether its protection is refusing Googlebot.
  4. Remove password protection from pages that are meant to be public.

Assistants’ crawlers are refused by the same rules, and should you block AI crawlers? covers that choice separately.

After the fix

Run the live test again, then use Validate fix. The neighbouring statuses are explained in server error (5xx) and in why your website is not showing up on Google.

Questions people ask

Why does Google get a 403 when the page works for me?

Because the block is selective. A firewall, a security plugin or the host is refusing requests that look automated, or requests from certain networks, and Google's crawler matches the rule.

What is the difference between 401 and 403 in Search Console?

A 401 means the page asked for a login and Google had none. A 403 means the server understood the request and refused it.

Should pages behind a login show these statuses?

Yes. A members' area or an admin page should refuse Google, and seeing it listed here is correct. The status is a problem only for pages meant to be public.

Free competitor gap report

A site that turns crawlers away cannot be ranked by them. Name up to three competitors and we test what your site and theirs return to search engines, then send you where yours refuses what theirs allows.

  1. Speed and technical health, side by side
  2. On-page SEO and site structure
  3. The content they are found for and you are not
  4. Who holds the searches that matter in your market
  5. A prioritised list of what to fix first
Request your free report by email
Address
contact@hadalmedusa.com
Include
your site; up to three competitors; where you compete

More in this series