Glossary 403 error
A 403 error (Forbidden) is an HTTP status code the server uses to say it has understood the request and refuses to fulfil it. Unlike a 401 error, it doesn't ask the client to identify itself: access is denied. Google treats it like any other 4xx: the URL stays out of the index, an already indexed URL is removed, and a 403 won't slow down crawling.
403 Forbidden: the server understands the request and refuses it. What it means, why it happens and what Google does with a URL that returns 403.
403 belongs to the 4xx class, client errors, and is defined today by RFC 9110 from June 2022, the standard that sets out HTTP semantics. Under that standard, the server may explain in its response why it refuses the request, and the reason doesn't have to involve credentials. If the server doesn't want to reveal that the resource exists, the RFC lets it respond with a 404 instead of a 403.
A server returns a 403 when a rule stops it from delivering the page to whoever asked for it. On the site operator's side, rules that can cause one include:
For Google, a 403 is just another 4xx error. Its documentation on status codes (last updated 4 February 2026) says all 4xx errors except 429 are treated the same: Google doesn't use the content of those URLs, doesn't index them and removes those already indexed. Crawl frequency for those URLs drops gradually.
The same documentation warns that 401 and 403 don't work for slowing down Googlebot: 4xx codes, except 429, have no effect on crawl rate. Gary Illyes repeated this on 17 February 2023 on the Google Search Central blog, recommending 500, 503 or 429 when Googlebot crawls too fast.
The robots.txt file is a separate case. If it returns a 403, Google treats it as if no valid robots.txt existed and assumes there are no crawl restrictions.
A 403 can be intended or accidental.
It's correct for areas that shouldn't be public, such as an admin panel, for folders whose contents shouldn't be listed, and for specific bots the operator has decided to refuse. If you don't want AI crawlers to read your site, you can refuse them at the server with a 403, as long as the rule doesn't catch Googlebot. Another option is charging them for access, known as pay per crawl.
It's accidental when the rule catches someone it shouldn't. The most sensitive case for SEO is Googlebot: a firewall or bot protection treats it like any other bot, or a country block shuts it out. Google explains in its documentation on locale-adaptive pages that Googlebot's default IP addresses appear to be based in the US, although it also crawls from IP addresses in other countries. A site that only admits visitors from Spain can therefore lock out its own crawling.
A shop turns on a block for every country except Spain in its CDN to stop attacks. Spanish users notice nothing, but Googlebot arrives with a US IP address and gets a 403. Product pages stop being indexed, and those already in the index are gradually removed.
A blog returns a 403 for /wp-admin/ to any visitor without a session. That's expected: the folder shouldn't appear in Google, and the 403 doesn't affect the rest of the site.
Search Console shows 403s in the page indexing report, under their own reason, "Blocked due to access forbidden (403)". The URL Inspection tool in Google Search Console lets you test live what Googlebot receives on a specific URL.
Outside Search Console, server and CDN logs show who got a 403. To tell whether it was the real Googlebot and not someone posing as it, Google says to run a reverse DNS lookup on the IP address, check that the name ends in googlebot.com, google.com or googleusercontent.com, and confirm with a forward DNS lookup that the name points back to the same IP. Google also publishes its IP ranges.
Used well, a 403 protects what shouldn't be public and tells the client plainly that it has no access, without redirecting it elsewhere. The drawback for SEO is that Google doesn't distinguish between an intended 403 and an accidental one: either way, the URL drops out of the index. Nor does it work as a crawl brake, because it doesn't change how fast Google crawls the site.
| Code | What the server says | What Google does |
|---|---|---|
| 401 Unauthorized | You need to identify yourself to get access | Doesn't index the URL, removes it if indexed |
| 403 Forbidden | The request is understood and refused | Doesn't index the URL, removes it if indexed |
| 404 Not Found | There's nothing at this address | Doesn't index the URL, removes it if indexed |
| 410 Gone | The resource no longer exists | Doesn't index the URL, removes it if indexed |
Source: RFC 9110 (June 2022); Google, "How HTTP status codes affect Google's crawlers", last updated 4 February 2026 (accessed 11.11.2026).
The full comparison between 401 and 403 is in the 401 error entry.
The sources don't define 403 in the same way: the Search Console Help says a 403 means the client sent credentials and wasn't granted access, so a 403 to Googlebot, which never sends credentials, would be a server mistake, while RFC 9110 says a request can be forbidden for reasons unrelated to credentials.
Google also doesn't say how long it takes to remove a URL that returns 403 from the index. Its documentation says the URL is removed and that crawling decreases "gradually", with no timeframe.
This entry was written in November 2026 with AI assistance. The facts come from RFC 9110, Google's documentation on status codes, robots.txt and verifying Googlebot, the Search Console Help and MDN. It was reviewed before publication and contains no client data.
A technical audit covers this and everything else in one pass.
Request an auditYes, if Googlebot receives it. Google doesn't index URLs that return 403 and removes those already in the index. If the 403 only covers private areas, there's nothing to lose.
The code says nothing about duration: it lasts as long as the rule causing it. While Google gets a 403, the URL stays out of the index and is crawled less and less. Once the rule is gone, you can request indexing again in Search Console.
Yes, a 403 is a correct way to refuse a specific bot. What matters is that the rule doesn't catch Googlebot, because then the site drops out of Google Search as well.
The server has decided not to give you access, and that decision belongs to whoever runs the site. If the block might be down to your network, for example a VPN or an IP address from another country, try without it. Otherwise only the site owner can fix it.
A 401 asks the client to identify itself, and the server has to say how. A 403 refuses the request even if the client identifies itself, or for reasons unrelated to identity. For Google, both keep the URL out of the index.