Search Console Page indexing: Why pages aren't indexed

Blocked due to access forbidden (403): the fix

Google says a 403 to Googlebot is returned incorrectly. How to find the firewall, CDN or server rule sending it and let verified Googlebot through.

Your server answered Googlebot with 403 Forbidden. Googlebot never sends credentials, so Google says a 403 to it is returned incorrectly. The usual cause is a firewall, CDN bot rule or country block rejecting Googlebot. Find the layer, allow verified Googlebot, confirm with a live test, then validate.

What "Blocked due to access forbidden (403)" means

Google: "HTTP 403 means that the user agent provided credentials, but was not granted access. However, Googlebot never provides credentials, so your server is returning this error incorrectly. The page will not be indexed." Like every 4xx except 429, a 403 tells Google the content is not there, and an indexed URL that starts returning it is removed.

Is it a problem?

Usually a problem

Yes, for any page that should be public. For pages that really are private, being left out of Search is the intended result; for public pages, a 403 to Googlebot usually means something in front of the site is rejecting crawlers.

Causes, most likely first

A web application firewall or CDN bot protection rule blocking Googlebot for its request rate or its user agent. Google warns that protection systems set to block unusually high request levels can block Googlebot.
A country or IP block. Google says Googlebot's default IP addresses appear to be in the USA, so a rule that blocks US visitors blocks much of Googlebot too.
Server rules that deny certain user agents, hotlinking or directory access, written for scrapers and catching Googlebot.
File or directory permissions on the server, or a directory with no index file and listing turned off.
A membership plugin answering 403 instead of asking for a login on pages meant to be public.

How to confirm it

Run the crawler versus browser checker. It fetches the URL as Googlebot, Bingbot, GPTBot and a browser, so a 403 for Googlebot alone shows up as a difference.
Run a live test in URL Inspection. If Google gets 403 and your browser does not, the block targets crawlers.
Check firewall and CDN security event logs for blocked requests to the URL with a Googlebot user agent, and verify those IPs by reverse DNS.

Crawler versus browser checker Indexability checker

How to fix it

Find the layer returning 403: CDN security events, firewall logs, then the origin server access log.
Allow verified Googlebot in that layer. Match on reverse DNS (googlebot.com, google.com or googleusercontent.com) or on Google's published IP ranges, not on the user agent string, which anyone can send.
If the rule is geographic, exempt verified Googlebot or narrow the rule.
Confirm with the crawler versus browser checker and a live URL test, then click Validate fix.

How long recovery takes

Google stops using a URL that keeps returning a 4xx and crawls it less and less often. Once the page returns 200 again it has to be recrawled, which Google says can take "anywhere from a few days to a few weeks". Request indexing in URL Inspection asks for one URL sooner but does not guarantee it.

After a fix, Validate fix on the issue asks Google to recheck the affected URLs. Google says validation "typically takes up to about two weeks, but in some cases can take much longer". Without it, the count still updates as Google recrawls, and an issue leaves the table once 90 days pass with no instance.

Would monitoring have caught it?

A monitored URL that starts returning 403 after returning 2xx or 3xx is a critical change, re-checked after 60 seconds before it alerts. A CDN or firewall that refuses our own crawler is reported separately, as a warning, because then we cannot see the page. A rule that rejects Googlebot by name while letting other crawlers through will not show up in monitoring; the crawler versus browser checker is the test for that.

stillindexed checks each monitored URL every 30 minutes on Starter and every 15 minutes on Agency, so the change is found on the next check and confirmed before it alerts, rather than waiting for this report to update.

See what monitoring covers

Six checks when a site disappears from Google

Sources

Every claim above about how Google behaves is from Google's own documentation, read on 2026-10-06. If Google has changed a page since, Google's page wins and we would like to know.