403 Gets Traffic

Element Code: OR-009

What this issue actually means

A 403 Forbidden is the server saying "I understood your request and I am refusing it." Unlike a 404, the resource may well exist. The server just will not serve it to this requester. When a 403 URL "gets traffic," it means people are clicking through from Google (or another organic source) and hitting that refusal. The only way that happens is that the URL was previously accessible, Google crawled and indexed it, and the access rules changed afterward while the listing stayed live in the results.

So this is really two problems stacked on top of each other. First, a URL that is now forbidden is still indexed and ranking. Second, real users are being funneled from search straight into a dead end. Neither is what you want, and the combination is worse than either alone because you are actively earning clicks that convert to nothing.

Why a 403 typically happens

Before you fix it, you need to know why the server is refusing. The common causes:

• Directory or file permissions that got tightened during a deploy or migration.
• Missing index file in a directory with directory listing disabled.
• IP, geo, or user-agent blocks in a firewall or WAF that are catching legitimate visitors or Googlebot.
• Authentication walls: staging protection, an .htaccess deny rule, or a login gate placed in front of a page that used to be public.
• Rate limiting or bot rules from a CDN or security plugin that are too aggressive.
• Hotlink protection or referrer rules that block requests arriving from search engines.

Where the value leaks out

The click already cost you a ranking position you spent effort earning. The 403 converts that hard-won visit into an immediate exit. Over time Google notices the page is no longer serving content, and the ranking that was feeding you traffic slides away too. You lose the visit now and the position later.

How to detect it

• Server access logs: the ground truth. Filter for status 403 and cross-reference the referrer against search engines and the user-agent against real browsers. Logs tell you exactly which URLs, how often, and from where.
• Google Search Console: the Pages (index coverage) report flags "Blocked due to access forbidden (403)," and the Performance report shows which of those URLs still earn impressions and clicks. That overlap is your priority list.
• Screaming Frog SEO Spider: crawl the site, filter the Response Codes tab for 403s, and use its Search Console and analytics integrations to overlay traffic onto the forbidden URLs in one view.
• Analytics (GA4 or similar): if your 403 page fires a pageview or you tag it, you can see landing-page sessions ending on the error. Bounce and zero-engagement patterns on specific URLs are a tell.
• Manual curl: curl -I the suspect URL, once as a normal browser user-agent and once as Googlebot, to see whether the 403 is universal or triggered by a specific requester.

How to fix it, step by step

The right fix depends entirely on one decision: should this URL be public or not?

1. Confirm the status and the cause. Curl the URL, read the server logs, and identify whether it is permissions, a firewall rule, an auth gate, or a CDN block.
2. Decide the URL's fate. If it should be live, the 403 is a bug. If it should be gone, the indexed listing is the bug.
3. If it should be public: fix the permissions, whitelist the blocked requesters, restore the index file, or relax the WAF rule until the URL returns a clean 200. Then request re-indexing in Search Console so the ranking has something real to point to.
4. If it should be gone: return a 404 (gone, unspecified) or a 410 (gone, permanent) instead of a 403. Google drops 404 and 410 URLs from the index far more cleanly than a 403, which it tends to keep around because "forbidden" implies the resource still exists.
5. If it moved: 301 redirect the old URL to the correct live destination so the ranking and any link equity transfer instead of evaporating.
6. Never mask it. Do not return a 200 with a "forbidden" message in the body. Soft errors keep the URL indexed and pollute your reporting.
7. Re-crawl and monitor. Confirm the new status code in Screaming Frog and watch Search Console until the 403 flag clears.

Which status code to send

Good versus broken

What "good" looks like

No URL that earns organic clicks returns a 403. Public pages resolve to 200, retired pages return 404 or 410 and fall out of the index, moved pages 301 to their new home, and any genuinely private area is both access-controlled and absent from search. Search Console shows no "access forbidden" pages that also carry impressions, and your logs show search referrers landing on live content, not refusals.

FAQ