What Is a 404 Error? 404 vs 403 Forbidden and How to Fix Them

A 404 error, or 404 Not Found, is the HTTP status code a web server returns when it has nothing to show at the requested URL. In the words of the HTTP standard, RFC 9110, the server "did not find a current representation for the target resource" or won't disclose that one exists. It doesn't say whether the page is gone for good.

Try it free: HTTP status codes Free to use, no account needed.

Its relative 403 Forbidden is different: the page may exist, but the server understood the request and refuses it. This guide covers what is a 404 error, what 403 Forbidden means, how both differ from 401 and 410, and how to find and fix them without hurting SEO. To look up any other code, search the free HTTP Status Codes list.

What is a 404 error? The official meaning

The 404 error meaning comes from RFC 9110, section 15.5.5, the current HTTP specification. Three details matter in practice:

• A 404 isn't permanent by definition. The page might come back. When a server knows the removal is permanent, the RFC prefers 410 Gone.
• A 404 can hide a page on purpose. A server that doesn't want to reveal that a forbidden resource exists may answer 404 instead of 403. GitHub, for example, returns 404 Not Found for private repositories when a request isn't properly authenticated, so outsiders can't confirm that the repository exists.
• The 4xx class means "client error", but in practice the cause is usually on the website: a deleted page or a broken link.

Sites word the message differently ("404 Not Found", "Page not found", "HTTP Error 404"), but the status code underneath is the same.

What does 403 Forbidden mean?

RFC 9110 defines 403 Forbidden this way: the server "understood the request but refuses to fulfill it". If the request carried credentials, the server considers them insufficient, and repeating the same request won't help. The page is there; you just aren't allowed to see it.

A 403 Forbidden error is often confused with 401:

• 401 Unauthorized means the request lacks valid credentials. The server must include a WWW-Authenticate header that says how to authenticate, and logging in with the right account may fix it.
• 403 Forbidden means the server refuses access. Logging in again with the same account won't help; you need different permissions, or the site owner has to change a rule.

Browsers usually show "403 Forbidden", "Access denied" or "HTTP Error 403", and the refusal may come from a firewall or CDN in front of the site rather than the site itself.

404 vs 410 vs 403 vs 401 at a glance

The names match the HTTP Status Codes reference, which also covers the 3xx redirects.

What to do when you see a 404 or 403 error

If you are a visitor, try these steps in order:

1. Check the URL for typos or text cut off at the end of a long link. Paths can be case-sensitive: /Contact/ and /contact/ may be different pages.
2. Reload the page. A page being republished can return an error for a moment.
3. Search the site. Delete the last part of the path or use the site's search box to find where the content moved.
4. For a 403, clear the site's cookies and cache. An expired session cookie can make a server refuse requests; signing out and in again helps for the same reason.
5. Turn off your VPN or proxy. Some sites and firewalls block VPN address ranges or whole countries with a 403.
6. Tell the site owner if the broken link came from the site itself.

Why a site returns 404 Not Found

For site owners, most 404s have one of these causes:

• Deleted or moved pages without a redirect, often after a redesign or a CMS migration.
• Typos in links, on your own pages or on other sites.
• Case sensitivity. On typical Linux servers, /Guide.html and /guide.html are different files.
• Trailing slashes. /pricing and /pricing/ are different URLs, and a server may serve one and return 404 for the other.
• Rewrite rules. A broken .htaccess rule, a changed permalink setting or a missing Nginx try_files line can send valid URLs to a 404.

What causes a 403 Forbidden error on your site

On your own site, a 403 Forbidden error usually comes from:

• File permissions. The web server must be able to read the files. On typical Linux hosting, files use 644 (rw-r--r--: the owner reads and writes, everyone else reads) and directories use 755 (rwxr-xr-x). Avoid 777, which lets anyone write.
• No index file with directory listing disabled. A request for a folder with no index.html or index.php gets a 403 when Apache has Options -Indexes or Nginx has autoindex off.
• Deny rules in .htaccess or the server configuration, such as Require all denied or an IP allowlist that doesn't include the visitor.
• A web application firewall or CDN that blocks IP addresses, countries, user agents or suspicious request patterns.
• Hotlink protection, which returns 403 for images requested from other domains.

How to fix 404 errors

The right fix depends on what happened to the page:

• The content moved: add a 301 redirect to the new URL, so visitors, links and search engines follow it.
• It was deleted by mistake: restore it at the same URL.
• Your own links are wrong: fix the menus, internal links and sitemap entries that point to the missing URL.
• It was removed on purpose: return 410 Gone (or keep the 404) and don't redirect it.

On Apache, all three can go in .htaccess:

Redirect 301 /old-guide/ /new-guide/
Redirect gone /spring-sale-2025/
ErrorDocument 404 /404.html

The Nginx equivalent is:

location = /old-guide/ { return 301 /new-guide/; }
location = /spring-sale-2025/ { return 410; }
error_page 404 /404.html;

A custom 404 page should say the page wasn't found, keep the site's navigation and offer search or popular links, and it must still send the 404 status code. On Apache, point ErrorDocument at a local path such as /404.html: with a full https:// URL, Apache redirects the visitor, and the original 404 status is lost.

Avoid soft 404s: pages that say "not found" but return 200 OK. Single-page apps that answer every route with 200 are a common source. Also don't redirect every missing URL to the homepage. Google's site-move guidance warns that sending many old URLs to one irrelevant destination, such as the homepage, can confuse users and might be treated as a soft 404.

Do 404 errors hurt SEO?

Not by themselves. Google Search Central has said that a site having some 404 URLs doesn't, on its own, hurt it or count against it in search results. Search Console's help adds that 404s aren't necessarily a problem when a page was removed without a replacement, and recommends fixing the 404s you link to yourself or list in your sitemap.

Two cases do cost you. A page that used to rank and now returns 404 drops out of the index with its traffic, so redirect it if a relevant replacement exists. And a soft 404 hides the real status, so Google's guide to soft 404 errors recommends a real 404 or 410 for removed pages and a 301 for moved ones.

On 404 vs 410: Google's documentation says it treats all 4xx codes except 429 the same way and removes a previously indexed URL from the index. Use 410 because it states your intent clearly, not to change rankings. A 403 or 401 on a page you want indexed is worse: Googlebot doesn't log in, so Search Console reports "Blocked due to access forbidden (403)" or "Blocked due to unauthorized request (401)" and the page isn't indexed. If a firewall blocks Googlebot, fix the rule.

How to find broken links and 404 errors

• Google Search Console: open Indexing › Pages and check the reasons "Not found (404)" and "Soft 404", which list the affected URLs.
• Server logs: they record every request with its status. In the common Apache and Nginx "combined" log format, field 7 is the path and field 9 is the status code, so this command lists the most requested missing URLs:

awk '$9 == 404 {print $7}' access.log | sort | uniq -c | sort -rn | head

On a sample log of seven requests, it printed 3 /old-guide/ and 1 /Contact/: one moved page that needs a redirect and one link with the wrong capital letter.

• Link checkers: a site crawler follows every internal link and reports the ones that return 4xx or 5xx; many can check outgoing links too.
• A quick manual check: curl -I https://example.com/old-guide/ fetches only the headers, and the first line shows the status, such as HTTP/2 404. The cURL Generator builds this command when you choose the HEAD method.

Look up any status code

The free HTTP Status Codes reference lists 63 standard codes, from 100 Continue to 511 Network Authentication Required, grouped into five classes. Type a number such as 404 or a word such as forbidden to see the matching code, its name and a short description in the page's language. It's a reference, not a URL checker: it doesn't fetch your pages, and unofficial codes such as Nginx's 499 aren't listed.

FAQ

Is a 404 error my fault?

Usually not. You may have mistyped the URL, but most 404s come from moved or deleted pages and links that were never updated.

Should I use 404 or 410 for a deleted page?

If the page was removed on purpose and won't return, 410 Gone is the most accurate answer; if you aren't sure, 404 is fine. If the content moved, use a 301 redirect instead.

Can clearing cookies fix a 403 Forbidden error?

Sometimes. If an expired or corrupted session cookie is the cause, clearing the site's cookies and signing in again fixes it. It won't help when the block comes from server permissions, an IP or country rule, or a VPN block.

What is a soft 404?

A page that tells visitors the content doesn't exist but returns 200 OK instead of 404. Google keeps such pages out of search results and flags them in Search Console. Return a real 404 or 410, or a 301 if the content moved.

Is a 404 a client error or a server error?

It belongs to the 4xx client-error class, because the requested URL has nothing to serve. A server failure shows up as a 5xx code, such as 500 Internal Server Error.

Try it free: HTTP status codes Free to use, no account needed.