root@hack3rs:/srv/www$ curl -i /403/
HTTP/1.1 403 Forbidden
The request was understood, but access is denied.
status-summary.log
HTTP 403 Forbidden
Authentication may be valid, but policy, ACLs, role assignments, or network controls are preventing access to this resource.
Treat this as an authorization or policy decision first, not an authentication bug.
likely-causes.lst
- $Role, group, or RBAC policy does not permit the requested action.
- $WAF, IP allowlist, geo restriction, or firewall rule blocked the request.
- $Directory or object permissions deny read/write access.
- $CSRF or origin policy validation failed.
recovery-steps.md
- Review authorization policy, role mappings, and resource ACLs.
- Check WAF/firewall logs for explicit deny events.
- Confirm the request origin, method, and CSRF token flow.
- Use least-privilege changes when granting access.
quick-actions.sh
ops-note.txt
Use these pages for debugging and user guidance. In production, configure your host or reverse proxy to return the matching HTTP status code for the route (especially for 403 and 404/500 responses) rather than serving a 200 with error-themed content.