HTTrack 403 Forbidden: Why It Happens and What to Do

An HTTrack 403 Forbidden error means the web server understood your downloader's request and decided not to answer it. It is rarely a bug in HTTrack or wget. Usually the site is doing one of five things: filtering by user agent, rate-limiting fast crawlers, running bot protection, requiring a login or cookie, or protecting its images from hotlinking. Which one it is decides what you can do. On your own site you can change the rule. On someone else's site, a 403 is usually a deliberate refusal that you should respect, and the Internet Archive may hold a copy you can use instead.

What does 403 Forbidden mean when HTTrack or wget copies a site?

HTTP status codes tell you how a server reacted. A 403 Forbidden says: I know what you want, and you are not getting it. It is different from the codes it is often confused with:

• 404 Not Found: the page does not exist. This is not a refusal.
• 401 Unauthorized: the page needs credentials, typically HTTP authentication.
• 429 Too Many Requests: you are going too fast. Many servers send a 403 for this as well, which hides the real reason.

In wget you will see ERROR 403: Forbidden. in the terminal. In HTTrack the refusal appears in the project's hts-log.txt file. If the very first page is refused, the error shown on screen is often the confusing "mirror is empty" message, covered below.

Five reasons a site refuses a website downloader

1. User-agent filtering. Every request carries a user-agent string that names the software. wget sends Wget/ followed by its version, and HTTrack identifies itself as HTTrack. Many firewall rule sets and security plugins block known downloader names by default, often without the site owner ever having thought about it.
2. Rate limits. A downloader asks for pages far faster than a person clicks. After a threshold, the server or CDN starts answering 403 (or 429) to your IP address for a while. The first pages download, then everything fails.
3. Bot-protection services. CDNs and web application firewalls can challenge visitors with a JavaScript check or a CAPTCHA. A browser runs the script and passes. HTTrack and wget do not execute JavaScript, so they receive the challenge page or a plain 403.
4. Login or cookie checks. Member areas, staging sites, age gates and some consent walls only serve content to requests that carry a session cookie. Without it you get a 403 or a redirect to a login page.
5. Hotlink protection. Images, fonts and videos are sometimes protected separately from the pages. The server checks the Referer header, or the files sit on a CDN that uses signed URLs which expire. The result is the classic partial failure: HTML downloads, images return 403.

How to diagnose an HTTrack 403 Forbidden error

Before changing anything, find out which of the five you are dealing with. Three quick checks narrow it down.

• Open the same address in a normal browser on the same connection. If the browser is refused too, your IP address is blocked or the page is genuinely restricted. If the browser works, the server is reacting to something about the tool.
• Look at the raw response. curl -I https://example.com/ shows the status and headers. Headers naming a CDN or firewall, or a response body that says something like "checking your browser", point to bot protection.
• Note when and where the 403s start. Check the log: is it the first request, after fifty pages, or only on files ending in .jpg, .png or .woff2?

If your copy opens but looks broken because images and stylesheets are missing, the cause is not always a 403. Wrong paths and assets on other domains produce the same look. The article on a downloaded website missing images and CSS walks through those cases.

Why does HTTrack say the mirror is empty?

HTTrack reports "MIRROR ERROR! HTTrack has detected that the current mirror is empty" when it finishes without saving any usable page. Open hts-log.txt in the project folder to see why. The usual causes are:

• The start page returned 403, so there was nothing to follow.
• The start page redirected from http to https, or from example.com to www.example.com, and HTTrack treated the new address as outside the project's scope. Start again with the exact address your browser ends up on.
• The page is built entirely with JavaScript, so the downloaded HTML contains no links to follow. See why copies of JavaScript sites go blank.

What should I change if the 403 comes from my own site's firewall?

When it is your site, the refusal is a setting you control. Work through the layers in order.

1. Find the layer that blocked you. Check the CDN or firewall event log, your security plugin's blocked-traffic list, and the server error log (ModSecurity rules log a rule ID there). The log entry tells you whether it was the user agent, the request rate or a bot score.
2. Add a temporary allow rule. If you run HTTrack or wget from your own machine, allowlist your IP address for the duration of the backup. This is better than allowlisting a user agent, which anyone can copy.
3. Remember where an online downloader's requests come from. If you use a browser-based service, the crawl comes from the service's servers, not your computer, so allowlisting your own IP does nothing. Instead, relax the specific rule that fired for the length of the crawl, for example by pausing a rate-limit rule or lowering the bot-protection level, and watch the log.
4. Slow the crawler down. With wget, add --wait=1 --random-wait --limit-rate=200k. With HTTrack, reduce simultaneous connections with -c2 and cap new connections per second with -%c1. A slower backup that finishes beats a fast one that gets banned halfway.
5. Give your backup an honest name. --user-agent='site-backup (owner@example.com)' in wget, or -F in HTTrack, makes your own requests easy to find in the logs.
6. Fix hotlink rules for assets. Make sure your own domain and empty referrers are allowed, especially if images are served from a separate CDN hostname.
7. Switch everything back afterwards. Temporary exceptions have a way of becoming permanent.

A crawled copy captures what visitors see, not your database, admin area or server code. For a complete safety net, keep a hosting or CMS backup as well. The guide to backing up a website before cancelling hosting explains why both copies matter, and converting WordPress to static HTML covers the WordPress-specific side.

If it's someone else's site: when a website refuses download, listen

Most forum answers stop at "change the user agent". On a site you do not run, that advice deserves a second look. A 403 is the site's answer to your request. Disguising your downloader as a browser, rotating IP addresses to dodge a rate limit, or trying to beat a bot challenge is not fixing an error. It is working around a decision someone else made.

• Read robots.txt. It is a request, not a technical barrier, but it states what the owner wants crawled. HTTrack and wget both follow it by default. Turning that off on someone else's site is exactly the behaviour that gets crawlers blocked in the first place.
• Check the terms of service. Many sites forbid automated copying in their terms, and breaking them can have contractual consequences even where nothing else applies.
• Ask the owner. A short message saying what you want to keep and why often works. Owners regularly agree to a slow crawl at a quiet time, or send an export, especially for archiving, research or a site they used to run.

On the legal side, the answer depends on your country and your situation. In general, copying publicly available pages for personal reference is treated differently from deliberately getting past an access control, and some jurisdictions have computer-misuse or anti-circumvention laws that apply to the latter. Having a copy also never gives you the right to republish someone else's content. This is not legal advice: if the copy matters for a business, a dispute or a court case, ask a lawyer first. For evidence specifically, read archiving a website for legal evidence.

What can I do if the live site cannot be downloaded at all?

Sometimes the live site simply will not cooperate: the owner has gone silent, the site has been taken down, or the protection is there for good reasons. You still have options.

Use the Wayback Machine capture

If the site was public at some point, the Internet Archive may have captured it. Today's firewall rules do not affect captures that were made years ago. The Wayback Machine downloader turns a chosen capture into a ZIP that opens offline, with the playback toolbar and the links back to archive.org removed. A restore of up to 100 pages is free, and the Wayback Restore plan restores up to 5000 subpages for a one-time 14.99 EUR (see pricing). The step-by-step guide to restoring a website from the Wayback Machine covers choosing a good capture date.

Be realistic about what this gives you. You get what the Archive captured, so pages it never crawled will be missing, and some owners ask for their sites to be excluded from the Archive altogether.

Why a clear 403 report beats an empty archive

Desktop tools often finish "successfully" with a folder of error pages, and you only notice weeks later that your backup is useless. Website Downloader takes the opposite approach: when a site refuses automated downloads, for example with a 403 response, the service reports that instead of handing you an empty ZIP. It does not try to get around the block. You know straight away that you need another route, whether that is asking the owner, relaxing your own firewall or restoring from the Archive.

Know what no copy can contain

Even when a download succeeds, some things never make it into an offline copy. Pages behind a login are not downloaded, and features that need a server stop working.

If you are still choosing a tool, wget vs HTTrack vs an online website downloader compares how each handles errors, scope and setup, and the FAQ answers common questions about what the service downloads.

FAQ

Can I get around a 403 Forbidden error when using wget or HTTrack?

On your own site, yes: allowlist your IP, relax the rule that fired, slow the crawl and set a recognisable user agent. On someone else's site, the honest fix is permission from the owner. Disguising your tool to get past a deliberate block can breach the site's terms and, depending on the country, the law.

Is the site blocking my IP address or only my user agent?

Open the same page in a normal browser on the same connection. If the browser is refused too, the block is on your IP address or applies to everyone. If the browser works and only wget or HTTrack fails, the server is reacting to the tool, usually its user agent, its speed or its inability to pass a JavaScript challenge.

Why do the pages download but the images return 403?

That is usually hotlink protection: the server or its CDN checks where image requests come from, or uses signed URLs that expire before the downloader fetches them. Images hosted on a separate domain with stricter rules cause the same symptom. On your own site, allow your domain and empty referrers for assets.

Is it legal to get around a block on a website?

It depends on the country, the site's terms and what exactly you do. Saving public pages for personal reference is generally viewed differently from deliberately defeating an access control, which some laws treat specifically. This article is not legal advice, so ask a lawyer before relying on a copy for business or legal purposes.