HTTP 403 means the server or an edge security service refused the monitoring request. It is an access decision, not proof that the application is unavailable to every visitor.
Common causes
- A WAF rule blocks the monitoring request.
- Bot protection requires browser verification or clearance cookies.
- An IP allowlist excludes the monitoring worker.
- A protected page requires a session or account.
- A CDN or reverse proxy applies a rule different from the origin.
How WebCheck presents it
A normal unexpected 403 is explained as Access forbidden. When WebCheck identifies Cloudflare challenge evidence, it uses the separate edge security warning so you can distinguish a challenge from an ordinary forbidden response.
What to do
- Inspect WAF, CDN and security-event logs for the request.
- Confirm that the monitored URL should be public.
- Allow only the required monitoring endpoint or service where appropriate.
- Use a dedicated public health endpoint instead of weakening protection across the site.
- Run the check again and compare the response evidence.
Limitation
Do not disable security controls merely to make WebCheck green. A browser with clearance cookies and a server-side monitoring request are different clients.