Common causes include restrictive file permissions, IP or user-agent blocks, misconfigured security rules, or a firewall/WAF blocking bots. Sometimes overzealous bot protection returns 403 to Googlebot itself.
That's the SEO risk: if your server or CDN blocks Googlebot with a 403, those pages can't be crawled and may be dropped from the index. Check that legitimate crawlers aren't caught by security rules, and verify with Search Console's URL Inspection and server logs.
If content is intentionally private, 403 (or 401) is appropriate. If it should be public and indexable, the 403 is a bug to fix, not a redirect target.
This is a technical SEO topic I handle for clients:
Technical SEO →
