Blocked Due to Access Forbidden 403: How to Fix It in Search Console

This guide shows you how to diagnose and fix blocked due to access forbidden 403 in Google Search Console, including firewall, CDN and security plugin causes that most short guides skip. When I run technical checks for clients, a 403 for Googlebot is usually a security tool doing its job a little too well.

Why does Googlebot get a 403 error?

Googlebot gets a 403 because something between Google and your page decided to refuse the request, even though a normal visitor may see the page fine. Google’s Page indexing report help explains that HTTP 403 means the user agent provided credentials but was not granted access, and that Googlebot never provides credentials, so your server is returning the error incorrectly.

The common sources I find, roughly in order of how often they appear:

• CDN or WAF bot protection that challenges or blocks automated traffic, including crawlers.
• Security plugins with rate limiting, country blocking or “block fake Google crawlers” rules that misfire.
• Hosting firewalls such as ModSecurity rules or host level bot filters.
• Server config like a Deny from rule in .htaccess, wrong folder permissions, or a missing index file in a directory.
• Geo blocking that refuses whole countries, which can catch Google’s crawlers since they mostly crawl from IP addresses in the United States.
• Members or staging areas that return 403 instead of a login page or noindex.

Does a 403 error affect SEO?

Yes, a 403 stops the affected page from being indexed, and pages that were already indexed are removed once Google keeps receiving the error. Google’s documentation on how HTTP status codes affect its crawlers says all 4xx errors except 429 are treated the same, so a 403 has the same indexing effect as a 404.

The same page also warns against using 401 or 403 to slow Googlebot down. If your real problem is server load, a 429 or 503 response for a short time is the signal Google understands as “crawl slower”, not a 403.

Use this decision table to decide what each affected URL should return:

How do I fix blocked due to access forbidden 403?

You fix it by finding which layer returns the 403 to Googlebot and adding an exception for verified Google crawlers, or by changing the response for URLs that should not be crawled at all. Follow these steps.

1. Export the URLs. In Search Console open Pages, click “Blocked due to access forbidden (403)” and export the examples. Mark which ones should be indexed.
2. Reproduce it. Inspect one URL and click Test live URL. If the live test also gets a 403, the block is active now.
3. Check from outside. Run curl -I -A "Googlebot" https://example.com/page/. A 403 here points to a user agent rule. A 200 here but a 403 in the live test points to an IP or bot score rule.
4. Read your logs. Look in your CDN or firewall security event log and your server access log for 403 responses to requests with a Googlebot user agent.
5. Verify the visitor really is Google. Google’s guide to verifying Googlebot describes a reverse DNS lookup that must end in googlebot.com, google.com or googleusercontent.com, plus a forward lookup back to the same IP, or matching the IP against Google’s published IP range files.
6. Add an allow rule for verified Google crawlers in the tool that blocked them. Many CDNs and security plugins have a verified bots option. Do not allow every request that merely claims to be Googlebot, because the user agent is easy to fake.
7. Remove geo or rate limits that catch Google’s IPs, or exempt verified crawlers from them.
8. Fix server config. Check .htaccess deny rules, file permissions (folders 755 and files 644 is the common default on Linux hosting) and that directories have an index file.
9. Clean up URLs that should stay private. Remove them from the sitemap and internal links so Google stops requesting them. My free SEO audit checklist includes these crawl checks.

How do I stop Cloudflare blocking Googlebot?

To stop a CDN such as Cloudflare from blocking Googlebot, find the specific security event that blocked the request and exempt verified search engine crawlers from that rule, instead of turning off protection completely. In the security events log, filter by the Googlebot user agent and look at which rule or feature took action.

• If a custom firewall rule caused it, add a condition that skips verified bots.
• If a country block caused it, review whether you really need to block that country for all traffic.
• If a bot protection mode caused it, check that mode’s settings and the provider’s documentation for how it treats verified crawlers.
• If rate limiting caused it, raise the threshold or exclude verified bots.

After each change, run the live test again. One change at a time makes it clear which rule was responsible.

How do I validate the fix in Search Console?

You validate by confirming a 200 response in the live test for a sample of fixed URLs and then clicking Validate fix on the 403 reason. Testing first matters, because validation fails if Google still hits the block on enough URLs.

1. Inspect a fixed URL, click Test live URL and confirm the page fetch is successful and a screenshot of the page appears.
2. Repeat for one URL from each folder or template you changed.
3. Request indexing for your most important pages.
4. Open the 403 reason in Pages and click Validate fix. Do not click again until it passes or fails.
5. Allow up to about two weeks, sometimes longer. If it fails, open See details, check the failed URLs against your firewall logs and start a new validation.

Also check the Crawl stats report under Settings in Search Console for a drop in 403 responses over the following days.

What does a 403 investigation look like?

If you would like a second pair of eyes on firewall and crawl settings, my technical SEO service covers this, and the Search Console errors guide explains the related 401 and 404 statuses.

Frequently asked questions

Sources

Facts checked against these official pages. Read how I check facts in my editorial policy.

• Google Search Console Help: Page indexing report
• Google Search Central: How HTTP status codes affect Google's crawlers
• Google Search Central: Verifying Googlebot and other Google crawlers