Diagnosing HTTP 401 and 403 Errors in Apache — Common Misconfigurations

Vahid Shaik <[email protected]> Mon, 2 Mar 2026 09:52:54 +0000
Newsgroups	gmane.comp.apache.user
Message-ID	<LV1P223MB130447FFAA5E05F390A356C8C47EA@LV1P223MB1304.NAMP223.PROD.OUTLOOK.COM>
--_000_LV1P223MB130447FFAA5E05F390A356C8C47EALV1P223MB1304NAMP_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

Hello,

I maintain a set of free HTTP diagnostic tools at DNS Robot (https://dnsrob=
ot.net<https://dnsrobot.net/>) and wanted to share some common Apache misco=
nfigurations I have encountered that cause unexpected 401 and 403 errors, i=
n case it helps others on this list.

1. Misplaced AuthType directives =97 placing AuthType Basic and Require val=
id-user in the root .htaccess instead of limiting it to /admin/ or a specif=
ic <Directory> block. This forces authentication on every page, including p=
ublic content and Googlebot requests (which kills SEO).

2. Incorrect ownership after deployment =97 after deploying with rsync or g=
it pull, file ownership changes to the deploying user instead of www-data. =
Files are readable by the owner but not by the Apache worker process. Fix: =
chown -R www-data:www-data /var/www/html/ after every deploy.

3. 403 on directories without DirectoryIndex =97 when Options -Indexes is s=
et (correctly, for security) but a directory has no index.html or index.php=
. Apache returns 403 instead of 404, which confuses both users and monitori=
ng tools.

4. SELinux silently causing 403 on CentOS/RHEL =97 file permissions show 75=
5/644 but Apache still returns 403. The fix is chcon -R -t httpd_sys_conten=
t_t /var/www/html/ to set the correct SELinux context. For debugging these =
issues, inspecting the response headers is often the fastest path. Our HTTP=
 Headers tool (https://dnsrobot.net/http-headers) lets you check any URL's =
status code and response headers instantly, which helps pinpoint whether th=
e 401/403 is coming from Apache, a reverse proxy, or a WAF like mod_securit=
y. Has anyone else run into edge cases with Apache auth configurations they=
 would like to share?

Best regards,

Shaik Vahid

DNS Robot =97 https://dnsrobot.net<https://dnsrobot.net/>

Free DNS & Network Diagnostic Tools


--_000_LV1P223MB130447FFAA5E05F390A356C8C47EALV1P223MB1304NAMP_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
</head>
<body>
<p style=3D"direction: ltr; text-align: left; text-indent: 0px; text-transf=
orm: none;">
<span style=3D"font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(=
0, 0, 0);">Hello,</span></p>
<p style=3D"direction: ltr; text-align: left; text-indent: 0px; text-transf=
orm: none;">
<span style=3D"font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(=
0, 0, 0);">I maintain a set of free HTTP diagnostic tools at DNS Robot (<a =
href=3D"https://dnsrobot.net/" target=3D"_blank" rel=3D"noopener noreferrer=
 nofollow" data-outlook-id=3D"4d2a46a6-6b7f-4534-aac0-ee5d3f036282" style=
=3D"margin-top: 0px; margin-bottom: 0px;">https://dnsrobot.net</a>)
 and wanted to share some common Apache misconfigurations I have encountere=
d that cause unexpected 401 and 403 errors, in case it helps others on this=
 list.</span></p>
<p style=3D"direction: ltr; text-align: left; text-indent: 0px; text-transf=
orm: none;">
<span style=3D"font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(=
0, 0, 0);">1. Misplaced AuthType directives =97 placing AuthType Basic and =
Require valid-user in the root .htaccess instead of limiting it to /admin/ =
or a specific &lt;Directory&gt; block. This
 forces authentication on every page, including public content and Googlebo=
t requests (which kills SEO).</span></p>
<p style=3D"direction: ltr; text-align: left; text-indent: 0px; text-transf=
orm: none;">
<span style=3D"font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(=
0, 0, 0);">2. Incorrect ownership after deployment =97 after deploying with=
 rsync or git pull, file ownership changes to the deploying user instead of=
 www-data. Files are readable by the
 owner but not by the Apache worker process. Fix: chown -R www-data:www-dat=
a /var/www/html/ after every deploy.</span></p>
<p style=3D"direction: ltr; text-align: left; text-indent: 0px; text-transf=
orm: none;">
<span style=3D"font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(=
0, 0, 0);">3. 403 on directories without DirectoryIndex =97 when Options -I=
ndexes is set (correctly, for security) but a directory has no index.html o=
r index.php. Apache returns 403 instead
 of 404, which confuses both users and monitoring tools.</span></p>
<p style=3D"direction: ltr; text-align: left; text-indent: 0px; text-transf=
orm: none;">
<span style=3D"font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(=
0, 0, 0);">4. SELinux silently causing 403 on CentOS/RHEL =97 file permissi=
ons show 755/644 but Apache still returns 403. The fix is chcon -R -t httpd=
_sys_content_t /var/www/html/ to set
 the correct SELinux context. For debugging these issues, inspecting the re=
sponse headers is often the fastest path. Our HTTP Headers tool (<a href=3D=
"https://dnsrobot.net/http-headers" target=3D"_blank" rel=3D"noopener noref=
errer nofollow" data-outlook-id=3D"dae9c738-12f9-4e0a-9e1f-683580328b86" st=
yle=3D"margin-top: 0px; margin-bottom: 0px;">https://dnsrobot.net/http-head=
ers</a>)
 lets you check any URL's status code and response headers instantly, which=
 helps pinpoint whether the 401/403 is coming from Apache, a reverse proxy,=
 or a WAF like mod_security. Has anyone else run into edge cases with Apach=
e auth configurations they would
 like to share?</span></p>
<p style=3D"direction: ltr; text-align: left; text-indent: 0px; text-transf=
orm: none;">
<span style=3D"font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(=
0, 0, 0);">Best regards,</span></p>
<p style=3D"direction: ltr; text-align: left; text-indent: 0px; text-transf=
orm: none;">
<span style=3D"font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(=
0, 0, 0);">Shaik Vahid</span></p>
<p style=3D"direction: ltr; text-align: left; text-indent: 0px; text-transf=
orm: none;">
<span style=3D"font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(=
0, 0, 0);">DNS Robot =97
<a href=3D"https://dnsrobot.net/" target=3D"_blank" rel=3D"noopener norefer=
rer nofollow" data-outlook-id=3D"dc757f2f-410d-4157-b8e0-08736aa8de99" styl=
e=3D"margin-top: 0px; margin-bottom: 0px;">
https://dnsrobot.net</a></span></p>
<p style=3D"direction: ltr; text-align: left; text-indent: 0px; text-transf=
orm: none;">
<span style=3D"font-family: Aptos, sans-serif; font-size: 12pt; color: rgb(=
0, 0, 0);">Free DNS &amp; Network Diagnostic Tools</span></p>
<div style=3D"direction: ltr; font-family: Aptos, sans-serif; font-size: 12=
pt; color: rgb(0, 0, 0);">
<br>
</div>
</body>
</html>

--_000_LV1P223MB130447FFAA5E05F390A356C8C47EALV1P223MB1304NAMP_--