Blocked due to access forbidden (403): when your server refuses Googlebot

Last updated: 2026-10-30

In short

This status means your server returned 403 Forbidden to Googlebot. Google points out that Googlebot never sends credentials, so a 403 to Googlebot is usually returned incorrectly. If the page should be in Google, find the firewall, CDN or server rule that blocks it and allow verified Googlebot.

Exact label in Search Console: Blocked due to access forbidden (403)

What it means

Google's Page indexing help explains that HTTP 403 means the user agent provided credentials but was not granted access. Googlebot never provides credentials, so your server is returning this error incorrectly, and the page will not be indexed. To get it indexed, admit non-signed-in users or explicitly allow Googlebot requests without authentication, after verifying its identity.

The block often sits in a security layer rather than in the page itself. In its advice on crawl errors, Google notes that protection systems are often set to block unusually high request volumes, and that Googlebot can trigger them because it makes more requests than a human visitor. Google also says not to use 403 to slow crawling: 4xx codes other than 429 have no effect on crawl rate.

Is it a problem?

Yes, if the URL is meant to be public. A 403 on public pages blocks indexing completely and, if it spreads to indexed pages, removes them over time. It is acceptable for private areas, although not linking to those URLs keeps the report cleaner.

Common causes

WAF or bot protection rules

Security services that challenge or block requests by user agent, request rate or reputation, sometimes catching Googlebot.

Country or IP blocking

Geo-blocking or IP deny lists that cover addresses Googlebot crawls from.

Directory or hotlink protection

Rules that forbid access to folders or file types such as PDFs or images.

File permission errors

Server file or directory permissions that do not allow the page to be read.

Rules against fake Googlebots gone wrong

Rules meant to stop impostors using the Googlebot user agent that block the real crawler too.

How to fix it

  1. Reproduce the 403. Run Test live URL. If the live test also gets a 403, the block is active now. Check access logs for 403 responses to Googlebot requests.
  2. Find the layer that blocks. Check CDN and WAF event logs, server configuration and security plugins. Google notes the firewall may not be under your control, so involve your hosting provider.
  3. Allow verified Googlebot. Allow Googlebot after verifying it with a reverse DNS lookup or Google's published IP ranges, not by user agent alone, so impostors stay blocked.
  4. Fix permissions. Correct file and directory permissions for public content.
  5. Request indexing and validate. Once the block is gone, request indexing for key URLs and click Validate fix on the issue.

Check it with GSC Magic

gsc_inspect_urls_batch reports the page fetch state for each URL, so your assistant can list every URL blocked with a 403 and show whether it is one directory, one file type or the whole site, which narrows down the rule responsible. If Bing Webmaster Tools is connected, bing_crawl_issues and bing_url_info show whether Bingbot is refused too, a hint that a security layer blocks crawlers in general.

gsc_inspect_urls_batchgsc_inspect_urlbing_crawl_issuesbing_url_info

Prompts to copy

Inspect these URLs and list every one blocked due to access forbidden (403). Group them by directory and file extension.

Check Bing crawl issues for my site and tell me whether Bing also gets 403 errors on the URLs Google reports as forbidden.

We changed our firewall rules today. Inspect these previously blocked URLs and tell me which ones Google still reports as 403.

Guides on the blog

Blocked due to unauthorized request (401)

This status means the server answered Googlebot with 401 Unauthorized, asking for credentials Googlebot does not have. If the page is private, that is correct and the page stays out of Google. If it should be public, remove the authorization requirement or, if you must keep it, let verified Googlebot requests through.

 Blocked due to other 4xx issue

This status means Googlebot received a 4xx client error that is not one of the codes with their own row, such as 401, 403 or 404. Google gives no further detail, so the first step is to find the exact code your server returned. Then fix how your server handles the request for pages that should be public.

 Server error (5xx)

Server error (5xx) means your server returned a 500-level error when Googlebot requested the page. Google slows crawling when it sees these errors and eventually drops URLs that keep failing. Check host status in Crawl Stats, reproduce the error, then fix capacity, timeouts or rules that block Googlebot.

Frequently asked questions

Why would my server send 403 to Googlebot?

Usually because of a security layer: a firewall, bot manager, geo or IP block, or a protection rule that reacts to request volume. Google notes Googlebot can trigger protection systems because it makes more requests than a person.

How do I allow Googlebot safely?

Verify requests with a reverse DNS lookup or against Google's published IP ranges, then allow them. Do not rely on the user agent string alone, because anyone can fake it.

Can I use 403 to reduce crawling?

No. Google says 401 and 403 have no effect on crawl rate. For short emergencies, Google recommends returning 503 or 429 temporarily.

Sources