What Is "403 Forbidden"?

In terms of Blogger problems, which occur seemingly randomly and have no obvious user solution, I can't think of too many that bring more dread into peoples hearts than

403 Forbidden

That message is actually where I started this blog - many, many years ago. It's come up, in discussion, several times.

The message "403 Forbidden" is literally a response by a computer somewhere, saying that you are not permitted to access this computer. For Blogger / Google customers, it generally has a slightly different origin.

The "403 Forbidden" message, for Blogger blog owners, is frequently the result of a networking technique, used by Google and owners of other large networks, for blocking suspicious network traffic.

"403 Forbidden" refers to suspicious network traffic, maybe from a bot cluster.

It generally means that some group of computers, in your ISPs address space, are controlled by somebody besides their legal owners - and are generating excessive network traffic which the Google networks are detecting as suspicious. The "suspicious activity" may involve brute force password guessing, or botnet driven new blog setup activity, or maybe excessive relaying of referer spam.

Some other Blogger account owner(s), somewhere else in the world, may be seeing a "Disabled account" notice, referring to "suspicious activity on your account", or maybe odd links to pornographic websites, from the Stats logs.

Google initially blocks the general address space, to examine the problem.

In order to continue service to the world in general, Google will block the problem computers, from access to their networks. If the Internet address used by your computer is similar to the addresses used by the problem computers, Google will block your computer, along with the other computers (your neighbours computers).

You may have to wait this problem out, as Google researches it.

If this happens to you, there's probably nothing that you can do but wait this out. One or more things will happen, eventually.

1. Other Google users will report the symptom - or validate their identity - and Google will research the problem.
2. Google will research the problem, reduce the range of addresses blocked, and remove the block on your specific address space.
3. The computers involved will go offline, or otherwise cease their attacks, and Google will remove the network block.

If you know how to, and if your Internet service allows you to do this, you may be able to change your Internet address. This solution won't be universally effective, though.

• Your Internet service ("Fixed IP") may not allow this.
• You may not know how to do this.
• Your Internet service may detect this change, by you, as suspicious activity.
• Your new address may also be blocked by Google, because of activity by another set of problem computers.
• Your new address may be blocked by another Internet service, and you'll have to start over with them.

So right now, I'll not go into the details of changing your address - though you may try doing this, if you wish. It's your computer, after all.

403 Forbidden Woes Continue

During the weekend of May 10 - 11, 2008, many Blogger readers were having trouble viewing our blogs. Instead of seeing The Real Blogger Status (and various other blogs of greater and lesser importance), some unhappy folks were seeing a well known problem

403 Forbidden.

Pete Hopkins, the Google Man In The Know, described the cause of the problem - the side effect of a massive Denial Of Service attack against Google, as

Blogger is currently experiencing a high level of automated requests. In order to keep Blogger running smoothly for as many people as possible, we are blocking some IPs.

and continued with

Just because your IP is blocked does not mean that you or your network is making automated requests, you've just gotten caught up in the block.

We are working to remove the incorrect blocks as soon as possible.

Yet as of this evening, it appears that not everybody is back to normal.

It's possible that you, or your readers, who are affected by this problem will be able to get around it by using a proxy server. Though you won't be reading this, if you're affected by the problem. Sorry.

For additional insight into this problem, see Robertos Report: The 403 Block.

>> Forum thread links: bX-*00078

>> Copy this tag: bX-*00078

>> Top