NGINX Technical Guide

How to Solve NGINX 403 Forbidden Error?

403 Forbidden means NGINX understood the request but denied access to the resource. The issue may be due to missing index file, folder execution permission, ownership, allow/deny rule, SELinux, symlink policy, or security layer.

403 ForbiddenPermission Deniedallow/denySELinuxIndex

Quick Diagnosis NGINX Support

root@server:~SSH

2026/07/17 03:31:08 [error] 2261#2261: *731 directory index of "/var/www/example/" is forbidden
2026/07/17 03:31:12 [error] 2261#2261: *734 open() "/var/www/example/index.php" failed (13: Permission denied)

Request flowClient, NGINX, and backend connection break point

ConfigurationValidation of active server and location blocks

Live diagnosisLog, socket, port, and service controls

Secure ApplicationTest, controlled reload and result verification

Technical description

What does NGINX 403 Forbidden mean?

403 is different from 404, which means file not found. NGINX may see the source or directory but configuration or operating system access request is blocked.

If the directory request does not find index.php or index.html and autoindex is off, NGINX writes 'directory index ... is forbidden'. In this case, instead of increasing permissions, the document root and index directive should be verified.

The file having 644 and the folder having 755 is not enough. The NGINX worker user must have execution permission on all parent folders up to the document root.

The allow and deny rules are evaluated in sequence. An inherited deny from the upper http/server block or a wrong IP network can lead to 403 being displayed for specific visitors.

SELinux context can block access even if Unix permissions appear correct on RHEL-based systems. The AVC log should be reviewed before the security layer is closed.

Using 777 for 403 solution is not a fix but a security vulnerability; namei, stat, NGINX worker, and security logs should prove the access chain.

Log messages and their meanings

403 Forbidden, permission denied and access rule messages

Search for the phrase you see in the email, browser, or SSH log. Each card includes meaning, probable cause, and safe initial action.

8 registration

01kritik

directory index of ... is forbidden

Meaning: No suitable index file in directory or directory listing is disabled.

Possible cause: Incorrect root, missing index or index directive.

Check the document root content and the effective index line.

02kritik

open() ... failed (13: Permission denied)

Meaning: NGINX cannot open the file at the operating system level.

Possible cause: File/folder permissions, ownership, ACL or SELinux.

use namei, getfacl, and -l to inspect all path components.

03warning

Access forbidden by rule

Meaning: NGINX allow/deny or similar access rule blocked the request.

Possible cause: Incorrect IP network, include file, or inherited from upper block.

nginx -T çıktısında allow, deny ve satisfy kurallarını bulun.

04warning

symbolic link not allowed or link target not accessible

Meaning: Symlink policy or target path access was denied.

Possible cause: disable_symlinks, permission or ownership mismatch.

Check the NGINX symlink directive using readlink -f.

05warning

403 Forbidden nginx

Meaning: The general browser message is not showing the root cause.

Possible cause: Index, permission, access rule or security layer.

Find the error_log line of the same request.

06warning

client denied by server configuration

Meaning: The server configuration rejected the client.

Possible cause: IP rule, location deny or Plesk extra directive.

Compare active rules with the client IP.

07bilgi

SELinux avc: denied

Meaning: Kernel security policy blocked NGINX access.

Possible cause: Incorrect context or required boolean closed.

examine the record with ausearch and plan for permanent context correction.

08bilgi

Primary script unknown

Meaning: FastCGI target is pointing to the wrong script path.

Possible cause: root/alias and SCRIPT_FILENAME incompatibility.

Verify the fastcgi_param SCRIPT_FILENAME value with the document root.

No records matching this expression were found.

Secure first review

SSH diagnostic commands and what output to look for?

Commands are for root access. Collect only status and logs first; Do not change the permanent setting without seeing the reason.

URL Permission Chain

namei -l /var/www/example/index.php
stat /var/www/example /var/www/example/index.php
getfacl -p /var/www/example 2>/dev/null

Displays the entire access chain including parent folders.

NGINX worker user

ps -eo user,group,cmd | grep '[n]ginx: worker'
grep -n '^user' /etc/nginx/nginx.conf

Determines the actual user who needs access to the files.

Root, index, and access rules

nginx -T | grep -nE 'server_name|root |alias |index |allow |deny |disable_symlinks'

Displays active virtual host and access directives.

SELinux control

getenforce
ls -Zd /var/www/example
ausearch -m AVC -ts recent | tail -n 50

Verifies SELinux restriction outside of Unix permissions.

Domain logs

tail -n 150 /var/log/nginx/error.log
curl -skI https://example.com/

Tests the request and log line at the same time.

Safe reload

nginx -t && systemctl reload nginx

If configuration is successful, it will run uninterrupted.

By hosting environment

Ubuntu/Debian, AlmaLinux/CloudLinux and Plesk controls

Although the root cause of the NGINX error is the same, package paths, service names, security layers and virtual host management vary depending on the Linux distribution or Plesk infrastructure used.

Ubuntu / Debian

Systemd, package path, and journald controls for NGINX 403 Forbidden.

First, verify the active NGINX configuration and service status.
Compare the domain error log with the systemd log in the same time range.
Run nginx -t before the change, then perform a graceful reload.

namei -l /var/www/example/index.php
nginx -T | grep -nE 'root |index |allow |deny '
tail -n 100 /var/log/nginx/error.log

AlmaLinux / CloudLinux

SELinux, PHP-FPM pool, and RHEL-based service controls for NGINX 403 Forbidden.

Check the active status of NGINX and related backend services.
Review SELinux AVC records and security contexts.
Do not restart the service without passing the configuration test.

namei -l /var/www/example/index.php
getenforce
ausearch -m AVC -ts recent | tail -n 30

Plesk Obsidian

Plesk-generated NGINX virtual host files in nginx 403 forbidden control.

Review the additional directives in the Domains > Apache & nginx Settings section.
Separate manually created and Plesk generated files.
If necessary, recreate the web configuration for the relevant domain only.

tail -n 100 /var/www/vhosts/system/example.com/logs/proxy_error_log
plesk repair web example.com -n
nginx -t

Safe solution order

NGINX 403 Forbidden solution sequence

First, determine why NGINX is rejecting it; test the index, permissions, access rules, and security layer separately.

Record the URL and client producing the 403 response

Determine if the error is for everyone, or only for a specific IP or domain.

curl -skI https://example.com/korumali/

Classify the error log message

Directory index, permission denied or access forbidden if found.

tail -n 100 /var/log/nginx/error.log

Verify the document root and index file.

Check that the active server block is looking at the real file path.

nginx -T | grep -nE 'server_name|root |index '

Test the permission chain

Execute permission for NGINX worker must be present in all parent folders.

namei -l /var/www/example/index.php

Review access and security rules

Separate allow/deny, ACL, SELinux and WAF logs.

nginx -T | grep -nE 'allow |deny '; ausearch -m AVC -ts recent | tail

Apply the narrowest fix and verify

Make changes only to the faulty path/rule and check the new 403 record.

nginx -t && systemctl reload nginx
curl -skI https://example.com/korumali/

Distinction by symptom

Special scenarios and decision trees

Directory is opening but index is missing

Add the correct index file or make a conscious autoindex decision.

ls -la /var/www/example; nginx -T | grep -n 'index '

Only one user/IP is affected.

Check allow/deny, WAF and fail2ban logs.

nginx -T | grep -nE 'allow |deny '

Symlink hedefinde 403

Examine the real target's permissions and disable_symlinks directive.

readlink -f /var/www/example/current; namei -l /var/www/example/current

Permissions are correct on RHEL but return a 403.

SELinux AVC logs and file context should be checked.

ls -Zd /var/www/example; ausearch -m AVC -ts recent | tail

WordPress uploads 403

Separate Uploads ownership, hotlink/WAF rule, and location matching.

curl -skI https://example.com/wp-content/uploads/test.jpg

Plesk 403 after NGINX directive addition

Review the Additional nginx directives content on the Domains screen.

plesk repair web example.com -n

Absolutely don't

Do not set folder and files to 777 collectively.
Do not permanently disable SELinux and hide the problem.
Do not unnecessarily open directory listing on the entire server.
Do not make direct permanent modifications to Plesk vhost files.
Don't assume that converting 403 to 404 solves the access issue.

Post-solution verification

Expected index or file returns 2xx/3xx code.
NGINX error_log is not generating new permission denied records.
Permissions are at least as permissive as the least privilege principle.
SELinux is running in enforcing mode with the correct context.
Only the targeted IP/directory access rule is applied.

Official technical resources

Official documentation of NGINX and related components

NGINX HTTP Core ModuleRequest body, header buffer, root, alias, and try_files directives

NGINX Access ModuleIP and network-based allow/deny access rules

NGINX Beginner’s GuideConfiguration test, signals, reload, and basic working model

NGINX FastCGI ModulePHP-FPM connection, FastCGI parameters and timeout settings

Internal SEO content set

NGINX 403 Forbidden Curiosities about

Why does NGINX 403 Forbidden occur?

Missing index file, incorrect root, file permissions, ownership, allow/deny rules, SELinux or security layer are the most common causes.

How to resolve 'Directory index of is forbidden'?

First, verify that the correct document root contains index.php or index.html and that the index directive contains this file.

Should chmod 777 be used for 403?

No. 777 security vulnerability creates and hides the real owner/access chain issue. name, stat, and worker user control should be performed.

Why do permissions result in a 403 even when they are correct?

SELinux, ACL, allow/deny, WAF, symlink policy, or incorrect document root Unix permissions may still produce a 403 error even if correct.

How to find the NGINX worker user?

Check the user directive in nginx.conf and the user of the running worker process with the ps command.

WordPress NGINX 403 Error Why?

Uploads permissions, security plugin, WAF, hotlink rule, deny location or incorrect PHP script path.

How to fix 403 in Plesk?

First, check the domain proxy_error_log and additional NGINX directives; if necessary, the plesk repair web command should be used for the relevant domain.

EKA SOFTWARE AND INFORMATION SYSTEMS

Let's fix the error on your server permanently

By analyzing cPanel, WHM, CloudLinux, LiteSpeed, MariaDB, Exim and security layers together, we fix the root cause of the failure instead of just removing the service.

Get Server Support WhatsApp

Custom Server Services

Standard Servers