Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsA 403 Forbidden response means Nginx received the request but refused to serve it. When Unix permissions are responsible, the Nginx worker account—often www-data on Debian and Ubuntu—cannot traverse one of the parent directories or read the file selected by the active root and URI. Read the error log while reproducing the request, identify the effective worker user and exact filesystem path, then grant only the required traversal and read permissions. A 403 can also come from Nginx access rules, authentication, or directory-index behavior, so confirm the cause before changing ownership.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What the 403 tells you
Nginx has several opportunities to reject a request. A 403 is different from a connection failure: the web server is running, accepted the request, matched a server configuration, and then decided that the response must not be delivered. The fastest fix is therefore evidence-driven rather than a blanket chmod.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →For a permissions-related error, four facts matter:
- The server block and
locationthat handled the request. - The effective
rootused for that location. - The Unix account running the Nginx worker process.
- The first directory or file in the resolved path that denies access.
On a regular Debian or Ubuntu package installation, the worker account is commonly www-data, and the default single-site configuration serves /var/www/html from /etc/nginx/sites-enabled/default. Neither convention is universal: a custom build, container, control panel, or another Linux distribution may use a different account or document root.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
How Nginx turns a URL into a file path
The root directive defines the directory Nginx searches for a file. Nginx appends the request URI to that root according to the matching location rules. If the active root is /var/www/site and the request is /assets/game.css, the path to investigate is normally /var/www/site/assets/game.css.
That mapping can be changed by a more specific location, an alias, a rewrite, a front-controller configuration, or an application rule. Do not assume the path from a distribution’s example file is still active. The path in the error log and the loaded configuration are the authority.
Step 1: watch the error log while reproducing the 403
The error log usually names the denied path and often states whether permission was denied, an access rule matched, or an index could not be found. Open a root shell or use sudo, start a live view, and make the failing request in another terminal or browser tab.
sudo tail -f /var/log/nginx/error.logUbuntu packages normally place logs under /var/log/nginx. If your installation uses a different location, inspect the active error_log directive. Nginx can also reveal the compiled default path with this command:
nginx -V 2>&1 | sed -n 's/.*--error-log-path=([^ ]*).*/1/p'Now request the exact URL that returns 403. A message containing permission denied and a filesystem path points toward Unix permissions. Messages mentioning access forbidden by rule, an authentication module, or a directory index indicate a different branch of troubleshooting. Keep the timestamp and complete path; they prevent you from fixing a similarly named file in the wrong site.
Step 2: confirm the loaded server block and root
Read the main configuration and every file it includes. On Ubuntu, start with /etc/nginx/nginx.conf, then inspect the files under /etc/nginx/sites-enabled/. Find the server block whose server_name and listen address match the request, followed by the most specific matching location.
Recommended Free Tools
sudo nginx -Tnginx -T prints the complete configuration Nginx has loaded, including included files. Search that output for the hostname, the URI prefix, root, alias, index, and allow/deny. A root declared in one server block does not apply if another block wins the host or port match. Likewise, a nested location can override the root you saw near the top of the file.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Write down the effective root and append the URI exactly as Nginx did. If the log shows a different path, investigate rewrites, aliases, symbolic links, or an application-generated response before changing permissions.
Step 3: verify the worker account instead of assuming www-data
The main-context user directive sets the account and group used by worker processes. Check it in the loaded configuration, then verify the running processes; a service may have been started with a packaged default, a custom unit, or a container-specific identity.
ps -eo user,group,pid,comm,args | grep '[n]ginx'The master process may run as root while workers run as an unprivileged account. File access for ordinary requests is evaluated using the worker’s credentials, not the master process’s account. If the workers are www-data, that is the account whose directory traversal and file-read permissions must be tested. If they use another account, substitute that name in every check and repair command.
Do not change the Nginx worker identity merely to bypass a 403. Running workers with broad privileges increases the impact of a compromised site and obscures the real ownership model.
Step 4: inspect every component of the path
A readable file can still produce 403 if any parent directory blocks traversal. Directory x permission means “search” or “traverse”; it is required to reach a child even when the child itself is mode 644. Nginx therefore needs search permission on the document root and every directory between the root filesystem and the requested file, plus read permission on the file.
Inspect the complete chain, not just index.html:
namei -l /var/www/site/assets/game.css
ls -ld /var /var/www /var/www/site /var/www/site/assets
ls -l /var/www/site/assets/game.css
stat /var/www/site/assets/game.cssIn the output, identify the owner, group, and mode of each directory. A directory such as /home/alex commonly has mode 700; that prevents www-data from traversing it even if /home/alex/public/index.html is mode 644. The same issue occurs with a private parent directory anywhere in the chain.
Test as the worker account when you need a direct confirmation. Reading a file and traversing a directory are separate operations:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
sudo -u www-data test -x /var/www/site && echo 'root is traversable'
sudo -u www-data test -r /var/www/site/assets/game.css && echo 'file is readable'Replace www-data and the path with the values you verified. If the first test fails, inspect parent directories with namei; if the second fails, inspect the file’s mode, group, ACLs, and symbolic-link target.
Choose a permission repair that matches your deployment
There is no single correct ownership command. The right model depends on who publishes files, whether Nginx or an application must write them, and how easily you need to undo the change.
| Repair model | Typical use | Security exposure | Maintenance and reversibility |
|---|---|---|---|
| Dedicated web root with controlled owner and modes | Static files or a deployment process that publishes to /var/www/site |
Low when directories are traversable and files are read-only to the web account | Easy to audit; moving content out of a private home directory removes hidden parent-directory blockers |
| Nginx-owned content | Only when the deployment model intentionally lets the web service create or modify the files | Higher impact if the site is compromised because the worker owns the tree | Simple for one service, but developer edits and rollback ownership can become awkward |
| Developer owner with a shared web group | Teams or deployment users that edit files while Nginx only serves them | Lower than world-writable permissions; write access is limited to group members and selected directories | Maintainable when set-group-ID directories and a controlled umask are used |
| Targeted ACL or group change | A legacy location must remain, or one service needs access to a narrow subtree | Can be least-privilege when applied to the exact path | Reversible, but ACLs must be documented and checked during migrations |
Whichever model you choose, grant only what the application requires. Serving static content normally needs directory traversal and file read access. Uploads, caches, and generated media may need write access in specific subdirectories; that does not justify making the entire document root writable.
Repair A: publish from a dedicated web root
A dedicated path avoids the private-home-directory problem and gives you a clear boundary for backups, deployments, and audits. Create the directory, copy or deploy the site there, and set ownership deliberately.
sudo install -d -o www-data -g www-data -m 755 /var/www/site
sudo rsync -a --delete ./public/ /var/www/site/The install command creates the root with explicit owner, group, and mode. The example assumes that Nginx is meant to own published content; if developers deploy files, use the shared-group model instead of blindly applying that ownership. Check the resulting files and directories with namei -l and stat, then make the Nginx root point to /var/www/site.
Do not run a recursive ownership change without deciding who should edit the files. chown -R www-data:www-data is appropriate only when the web service is intentionally the content owner. It can otherwise prevent the deployment user from updating files and may give a compromised worker more control than necessary.
Repair B: keep developer ownership and use a shared group
For a developer-managed site, make a deployment group, add the relevant users, and place the web tree in that group. Nginx needs group read and traversal access; it does not need ownership or group write access for static files.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
sudo groupadd --system webpublish
sudo usermod -aG webpublish deployer
sudo usermod -aG webpublish www-data
sudo chown -R deployer:webpublish /var/www/site
sudo find /var/www/site -type d -exec chmod 2750 {} ;
sudo find /var/www/site -type f -exec chmod 0640 {} ;The set-group-ID bit (2 in directory mode 2750) keeps newly created files and directories in the shared group. The exact modes depend on whether other local users need access; the important properties are group search permission on every directory and group read permission on served files. A deployment process should use a umask that preserves those group permissions rather than recreating unreadable files on every release.
Free tools Windows power users keep installed
One-click scans. No signup required.
Users added to a group may need to start a new login session before the membership appears. Verify the worker’s group list after restarting the service or otherwise applying the account change. If the application writes uploads, grant group write only to the upload directory, for example with a separate mode and ownership, rather than to the whole site.
Repair C: address a document root under /home
Keeping published files under /home/<user> often fails because the home directory itself is private. Changing only the file to 644 does not help when www-data cannot traverse /home/<user>.
The safer long-term fix is to move or deploy the public files into a dedicated path such as /var/www/site and update the active root. If the home-directory layout is unavoidable, grant narrowly scoped traversal on each required parent and verify that no unrelated private files become reachable. A broad change such as making the entire home directory world-traversable exposes more data than the web server needs.
After any move, check symbolic links. A link inside the web root can point back into a private directory and recreate the same denial, or expose files that were never intended for publication.
When the 403 is not a Unix permission problem
Access rules
allow and deny directives can deliberately return 403 even when the filesystem is readable. Review inherited and nested rules in the loaded configuration, including restrictions by client address or authentication state. The error-log wording normally distinguishes an access rule from an operating-system permission failure.
Authentication and application authorization
Basic authentication, an access module, or an upstream application can reject a request after Nginx has located the resource. Check the matching location, authentication directives, and upstream response handling before changing file ownership.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Missing index with directory listing disabled
A request for /assets/ may map to a real directory but have no configured index file. If directory listing is disabled, Nginx can return 403 rather than show a directory contents page. Request a known file, inspect the index directive, and decide whether an index file or an intentional listing policy is appropriate. Do not enable directory listing merely to hide a configuration mistake; it may reveal filenames that should remain private.
Wrong server block or location
A hostname, port, or URI may match a different server block than expected. Compare the request’s Host header and port with the loaded configuration, and use nginx -T to find duplicate or more-specific locations. Fixing permissions in an unused root has no effect on the request that is actually failing.
Validate the change safely
- Run a syntax and configuration test:
sudo nginx -t. Do not reload a configuration that fails this test. - Reload Nginx so a changed configuration or worker identity takes effect:
sudo systemctl reload nginx. - Request the site locally and inspect headers:
curl -I http://127.0.0.1/. Use the correct host header or URI if the server relies on name-based routing. - Watch
/var/log/nginx/error.logand the access log while repeating the original request. Confirm that the 403 is gone and that no new path is being denied. - Test a representative static file, an application entry point, and any upload or generated-content path separately. A fix for
index.htmldoes not prove that every location has the required permissions.
The standard Nginx installation layout places configuration under /etc/nginx and logs under /var/log/nginx, but custom packages and containers can differ. Always use the paths shown by the running service and its loaded configuration.
Common failed fixes and how to recover
chmod -R 777
This grants every local user and process read, write, and traversal access. It masks which permission was actually required and allows a compromised process to alter the site. Replace it with explicit owner, group, directory, and file modes. If you already used it, record the intended deployment users, reset ownership, then apply separate directory and file modes as in the shared-group example.
Changing only the target file
Making index.html readable cannot overcome a parent directory without search permission. Use namei -l to find the first blocked component and change only that component or move the published tree.
Changing ownership recursively without a rollback plan
A recursive chown can disrupt deployments, backups, or application-generated files. Before using it, decide whether Nginx, a deploy user, or a shared group is the intended owner. Capture the current ownership with find or a filesystem snapshot where available, and change only the subtree that belongs to the site.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Assuming www-data is always correct
Worker accounts vary by distribution and installation method. If the effective worker is another user, granting access to www-data will not change the request outcome. Verify the process and configuration first.
Fixing the wrong root
Multiple sites and nested locations can make an apparently correct change irrelevant. Use the error-log path, nginx -T, and the request’s host and URI together. If those three do not identify the same tree, stop and resolve the routing mismatch before editing permissions.
A repeatable checklist for future 403 errors
- Reproduce the request while following the Nginx error log.
- Copy the exact denied path and error reason from the log.
- Confirm the matching server and location, then record the effective
rootoralias. - Verify the worker account and group from the configuration and running processes.
- Use
namei -lto inspect every parent directory andstatto inspect the target. - Choose a dedicated-root, Nginx-owned, shared-group, or narrowly scoped ACL model based on who must write files.
- Give directories traversal permission and files read permission; add write permission only to directories that truly need it.
- Check access rules, authentication, index behavior, and server-block selection before declaring a Unix permission fix complete.
- Run
nginx -t, reload, test withcurl -I, and watch both logs during verification.
Bottom line
Fix a permissions-based Nginx 403 by following the request to its real path, verifying the actual worker account, and correcting the first directory or file that blocks that account. On Debian and Ubuntu this often means giving www-data traversal through a dedicated web root and read access to the published files, not handing ownership of an entire home directory to the web server. Keep the repair narrow, then rule out Nginx access policies and directory-index behavior before making broader changes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
