Fix HTTP Error 403.14 Forbidden in IIS

HTTP Error 403.14 – Forbidden appears when Internet Information Services (IIS) cannot find a default document (like index.html or default.aspx) in the requested folder, or when directory browsing is disabled. This guide walks you through the most common fixes, from enabling default documents to adjusting permissions, so you can get your site serving content again quickly.

What You’ll Need

• Access to the IIS Manager (usually via Administrative Tools or by typing inetmgr in the Run dialog).
• Administrator rights on the Windows server or machine running IIS.
• Basic knowledge of where your website’s files are stored (e.g., C:\inetpub\wwwroot or a custom path).
• Optional: Command Prompt (as Administrator) for running IIS reset commands.

Step-by-Step

1. Identify the affected site or folder. In IIS Manager, expand the server node, then Sites, and select the website that’s returning the 403.14 error. If the error appears for a subfolder, note which one.
2. Check the default document settings. With the site (or folder) selected, double-click Default Document in the middle pane. Ensure that at least one of your actual homepage files is listed (e.g., index.html, default.htm, default.aspx). If not, click Add… on the right, type the filename (e.g., index.html), and click OK. Move it to the top if needed using Move Up.
3. Enable directory browsing (temporary workaround). If you’re sure the file exists but still get the error, double-click Directory Browsing and click Enable on the right. This will show a file listing instead of the error, which can help confirm the file is present. (Disable it again after fixing the root cause for security.)
4. Verify the physical path and file existence. In IIS Manager, select the site and click Basic Settings on the right. Confirm the Physical path points to the correct folder. Then open that folder in File Explorer and verify the default document (e.g., index.html) actually exists there. If it’s missing, upload or create it.
5. Check NTFS permissions. Right-click the site’s folder in File Explorer, select Properties → Security. Ensure that IIS_IUSRS (or the specific app pool identity) has at least Read permission. If not, click Edit → Add, type IIS_IUSRS, click Check Names, then OK. Grant Read (and List folder contents) and apply.
6. Restart the site or IIS. In IIS Manager, right-click the site and choose Restart. If that doesn’t help, open Command Prompt as Administrator and run iisreset to restart all of IIS.
7. Clear browser cache and retest. Sometimes the browser caches the error page. Hard refresh (Ctrl+F5) or open in an incognito window.

Common Mistakes

• Wrong default document name: IIS is case-insensitive, but the name must match exactly (e.g., index.html vs Index.html is fine, but index.htm is a different file).
• File is actually a .txt or .html.txt: Windows hides known file extensions by default, so index.html might actually be index.html.txt. Enable “File name extensionsâ€� in File Explorer to check.
• Missing ASP.NET feature: If your site uses ASP.NET (e.g., default.aspx), the .NET Framework might not be installed or enabled in IIS. Check Programs and Features → Turn Windows features on or off → Internet Information Services → World Wide Web Services → Application Development Features and enable ASP.NET.
• Permissions on parent folders: Even if the site folder has read permissions, the parent folders (like C:\inetpub) must also allow traversal. Grant Read to IIS_IUSRS on the entire path if needed.
• URL rewrite rules interfering: If you have URL Rewrite module installed, a rule might be blocking requests. Temporarily disable any custom rewrite rules to test.

Tips

• Use the “Browseâ€� feature: In IIS Manager, right-click the site and select Manage Website → Browse. This opens the site’s root URL and often gives a more specific error.
• Check the Application Pool: Ensure the app pool is started. If it’s stopped, start it. Also, the app pool’s .NET CLR version should match your site’s framework (e.g., v4.0 for .NET 4.x).
• Log files: Check C:\inetpub\logs\LogFiles\W3SVC[siteID] for detailed error codes (e.g., 403.14) and timestamps.
• Use Failed Request Tracing: If the error persists, enable Failed Request Tracing on the site, reproduce the error, and view the trace log to see exactly which module is rejecting the request.

Troubleshooting

If the error persists after following all steps:

• Check the web.config file: A malformed web.config in the site root or subfolder can cause 403 errors. Temporarily rename it to web.config.bak and retest. If the site works, the config is the culprit.
• Verify the site is not overridden by a parent configuration: If your site is under a parent site (like Default Web Site), inheritance might block default documents. In IIS Manager, click the site and look at the Configuration Editor to see if defaultDocument is overridden.
• Test with a static HTML file: Create a simple test.html in the site root and browse to http://yourdomain/test.html. If that works, the issue is specific to default documents or dynamic content.
• Check for antivirus or security software: Some security tools block IIS requests. Temporarily disable them to test (but re-enable after).
• Reinstall IIS features: As a last resort, uninstall and reinstall the IIS role or specific features (like Static Content) via Server Manager.

Frequently Asked Questions

Why do I get 403.14 even though the file exists?

Most often it’s because the default document list doesn’t include that file name, or the file has a different extension (e.g., index.php but PHP isn’t installed). Check both the Default Document list and the actual file name.

Can I just enable directory browsing to fix it?

Yes, it will hide the error and show a file list, but it’s a security risk and not a proper fix. You should still add the correct default document or provide a link to the file.

What’s the difference between 403.14 and 403.2?

403.14 specifically means “Directory listing denied� because no default document is set and directory browsing is off. 403.2 means “Read access denied� – often a permissions issue.

Does this error happen on shared hosting?

It can, but on shared hosting you usually don’t have access to IIS Manager. You’d need to upload a file named index.html or default.htm to the root folder via FTP or a file manager.

How do I add a default document for a subfolder only?

In IIS Manager, select the subfolder, then double-click Default Document. Add the desired file name. It will override the parent setting for that folder.

After fixing, should I disable directory browsing?

Yes, unless you intentionally want users to see a file listing. It’s a security best practice to keep directory browsing disabled.

Related

• Is Nextcloud Worth Self-Hosting?
• Restore Closed Tabs? How to Reopen in Any Browser
• Kodi vs Plex: Which Media Server Is Right?