403 vs 401 HTTP Status Codes: What's the Real Difference?

A 401 Unauthorized response means the client has not yet proven who they are. A 403 Forbidden response means the server knows who the client is but refuses access regardless. Choosing the wrong code misleads developers, breaks security tooling, and can expose information about your access-control model.

What is the difference between 401 and 403?

Both codes live in the 4xx client-error family, but they describe different failure modes. A 401 fires when authentication is absent or invalid — the server cannot identify the requester. A 403 fires when authentication succeeded (or is not required) but the requester's identity still does not carry the right permissions.

The RFC 9110 specification (the current HTTP semantics standard) is explicit: a 401 response MUST include a `WWW-Authenticate` header that tells the client how to authenticate. A 403 carries no such obligation, because no credential change will fix the problem.

Should I use 401 or 403?

Use 401 when the request lacks any credential, or when the credential provided is expired, malformed, or unrecognized. The client should be prompted to log in or refresh its token.

Use 403 when the credential is valid and recognized, but the authenticated identity does not have the role, scope, or ownership required for the requested resource. Sending another credential of the same type will not help.

A practical decision tree:

1. Is there a valid, recognized session or token? No → 401.
2. Does that identity have permission for this resource? No → 403.
3. Does the resource not exist at all? → Consider 404 (to avoid confirming the resource exists to an unauthorized caller).

Security note: some APIs deliberately return 404 instead of 403 to avoid leaking the existence of private resources. This is a valid defensive choice, but document it explicitly so your own developers are not confused during debugging.

What causes a 401 error and how do you fix it?

Common causes of a 401:

• No Authorization header — the client forgot to attach the token.
• Expired JWT or session cookie — the credential was once valid but has timed out.
• Wrong token format — sending a Bearer token where Basic auth is expected.
• Revoked API key — the key existed but was invalidated server-side.

Fixes: refresh the token, re-authenticate, or correct the Authorization header format. The server's `WWW-Authenticate` header should tell the client which scheme to use.

What causes a 403 error and how do you fix it?

Common causes of a 403:

• Insufficient role — a regular user tries to access an admin endpoint.
• IP allowlist block — the server only accepts requests from specific addresses.
• Ownership check failure — a user tries to edit another user's resource.
• Missing scope in OAuth token — the token was issued without the required scope.
• File-system permission — on a web server, the process lacks read rights on the file.

Fixes: elevate the user's role, add the IP to the allowlist, request a token with the correct scope, or correct server file permissions. Re-authenticating with the same credentials will not resolve a 403.

How do these errors affect SEO and AI crawlers?

This is where the choice of status code has consequences beyond your API. Search engine crawlers and AI crawlers treat 401 and 403 differently.

A 403 returned to Googlebot signals that the page is intentionally blocked. Google will typically drop the URL from its index over time. A 401 may prompt a crawler to retry with credentials — but since crawlers rarely carry credentials, the practical outcome is similar: the page is not indexed.

For AI crawlers such as GPTBot (used by ChatGPT) and ClaudeBot, a 403 is the standard way to deny access. If you want to selectively allow or block AI crawlers, the cleaner approach is to configure `robots.txt` or an `llms.txt` file rather than relying on HTTP status codes alone. Our guide on what llms.txt is and whether it works in 2026 covers the mechanics in detail.

From SeoVision's own automated audits — run across 874 websites as of 2026-08-12 — 20% of audited sites had H1 tag issues flagged, and 32% failed the brand-name search-ranking check. These are not directly caused by 401/403 misuse, but they illustrate how technical configuration errors compound: a misconfigured access response can prevent a page from being indexed at all, which then cascades into ranking and citation failures. The audit data comes from automated checks of real sites in SeoVision's database, so these figures reflect that specific corpus, not a universal industry benchmark.

If you are tracking whether AI assistants cite your brand, a 403 returned to an AI crawler means that content is invisible to the model — it cannot be cited. Understanding how AI search engines work helps clarify why crawler access is a prerequisite for AI visibility.

What the data does not prove

SeoVision's audit corpus covers 874 sites as of 2026-08-12. That is a real but limited sample. The median SEO score of 75/100 across those sites reflects the specific population of sites that ran an audit — likely skewed toward teams already paying attention to technical health. Sites with severe access-control misconfigurations may never have run an audit at all, meaning the true prevalence of 401/403 errors in the wild could be higher or lower than our data suggests. A single audit snapshot is not a trend; sustained direction would require tracking the same sites over multiple periods.

Additionally, the impact of returning 401 vs 403 on crawler behavior depends heavily on the crawler implementation. Not all AI crawlers behave identically, and crawler policies change. What holds today may not hold in six months.

Is a 403b better than a 401k? (Retirement plan clarification)

Search engines surface both meanings of "403 vs 401" because the same numbers refer to US retirement savings plans. This article covers HTTP status codes. For the retirement plan question: a 403(b) is a tax-advantaged plan offered by nonprofits, public schools, and certain government employers; a 401(k) is offered by for-profit companies. Neither is universally "better" — eligibility depends on your employer. If you landed here looking for retirement plan guidance, the Fidelity and Empower resources in the search results cover that topic thoroughly.

What to do next

1. Audit your API responses this week. Search your codebase for every place you return a 4xx status. Verify that 401 is only used when no valid credential is present, and 403 is used when a valid credential lacks permission.
2. Add the `WWW-Authenticate` header to every 401 response. This is required by RFC 9110 and helps clients (and debugging tools) understand how to authenticate.
3. Check your robots.txt and llms.txt. If you are intentionally blocking AI crawlers, use `robots.txt` directives rather than relying on a 403 response alone. Read what llms.txt is and whether it works in 2026 for the current best practice.
4. Run a technical audit on your site. SeoVision's free instant audit checks for crawlability signals, H1 issues, and brand-ranking failures — the same checks that surfaced the figures cited in this article. Go to seovision.io to run it at no cost.
5. Monitor whether AI assistants can see your content. If key pages return 403 to AI crawlers, they will not appear in AI-generated answers. SeoVision tracks citations across 9 AI engines; use it to confirm your content is actually reachable and being cited. See the best AI visibility tools in 2026 for a broader comparison of your options.