The Apache message “client denied by server configuration” points to an authorization rule, not a missing page. If the same URL works intermittently, first determine whether requests reach different backend nodes, virtual hosts, paths, or apparent client IPs.
Last updated: October 14, 2026.
# Validate syntax and inspect the selected virtual-host mapping.
apachectl configtest
apachectl -S
# Search loaded configuration and per-directory files for access rules.
grep -RniE 'Require|Allow|Deny|AuthMerging' /etc/apache2 /var/www/exampleUse the configuration paths for the actual server and protect command output because it may reveal internal hostnames and directories. On managed hosting, provide the timestamp, URL, and log entry to the provider instead of changing global configuration.
Find the rule that evaluated the request
Apache’s mod_authz_core documentation defines Require and the authorization containers that combine rules. Check the matching <Directory>, <Location>, and .htaccess sections for the denied filesystem path shown in the error log, not only the browser URL.
Avoid adding Require all granted globally. It is appropriate only when that directory is intended to be public and no narrower authentication or IP rule should apply.
Explain why a deterministic rule looks intermittent
Compare the process, hostname, virtual host, and client address recorded for successful and denied requests. Behind a CDN or reverse proxy, an IP-based rule may see different proxy addresses unless trusted forwarding is configured correctly. In a cluster, one node may have an older virtual-host or .htaccess configuration.
Add a temporary, non-sensitive response marker for the backend node if the environment permits it, or correlate request IDs through the proxy and Apache logs. Test the same asset repeatedly and compare which node denies it. Remove diagnostic headers after the nodes are reconciled.
Apache’s authentication and authorization guide discourages mixing legacy Order, Allow, and Deny directives with modern Require rules. Normalize the configuration, deploy it consistently, reload safely, and verify several static and dynamic URLs.
Continue with Apache virtual-host matching, duplicate Apache listen directives, and CMS 403 WAF diagnosis.
