Chapter 08
When you get a 403
Sites and folders can be locked to a list of unlocked IP addresses. If yours is not on that list you get a refusal with no explanation — so the first job is recognising what you are looking at.
How locking works
A locked site or folder serves only requests from unlocked IP addresses. Everyone else gets a 403, refused at the proxy before your application is ever consulted. Two shapes exist:
- The whole site is locked — nothing is reachable except from an approved address.
- Specific folders are locked, such as an admin area, while the rest of the site stays public.
A whole-site lock supersedes the folder list. Locks apply to aliases too, so there is no way around one by using a different domain.
The list is global rather than per-site: an approved address passes everywhere it is allowed. It keeps working even if the control panel itself is stopped, because enforcement lives in the proxy and not in the panel.
Telling the two 403s apart
They look completely different, and the difference tells you what to do.
| A locked site or folder | The panel refusing you | |
|---|---|---|
| What you see | A blank browser error page. No branding, no words, no links. | A styled Nimbus page reading "You do not have access to this part of the panel." |
| What it means | Your IP address is not unlocked. | You are signed in, but your account does not have admin rights. |
| What to do | Unlock your IP address — see below. | Nothing you can fix yourself. Ask your operator, or sign out if you used the wrong account. |
The blank one is the one you can act on. It is deliberately bare — the refusal happens at the proxy, which knows nothing about who you are or that a panel exists.
Unlocking your IP address
The control panel's own domain is never lockable. That is the way back in, and it always answers.
- Go to the panel's domain — ask your operator for it if you do not have it, and keep it somewhere you can find without a working site.
- Sign in. The panel takes you straight to IP unlock.
- Your current IP address is shown under "Your address", with a line telling you whether it is unlocked.
- Press "Unlock my IP address".
- Reload the site that refused you. It should serve immediately — the change takes effect right away, not after a delay.
Unlocking replaces your previous IP address rather than adding to it. Moving between networks — office to home, or onto mobile data — means the old address stops working the moment you unlock the new one.
If the page tells you that you are currently unlocked from a different address, that is exactly what has happened: you moved. Press the button again to move your entry to where you are now.
The page has no address field. It unlocks the IP address the request actually came from, and nothing else — there is no way to type in a colleague's address or a range. Anyone needing access must sign in themselves, from the place they need access from.
The practical consequence: a VPN, a proxy, or a mobile connection that changes address needs unlocking again each time the address changes.
What you can see in the panel
If your account is a plain unlock account rather than an admin, the panel is small on purpose. You get the IP unlock page and a sign-out button — no site list, no settings, and no view of whose IP addresses are unlocked. Managing sites is done by your operator.
If you land on a 403 inside the panel itself, the page always offers a way out: a link to IP unlock and a sign-out button. You should never need to clear cookies to escape.
If it still refuses you
- Check the address actually changed. The unlock page shows what the panel sees. If that does not match what you expect, something between you and the box — a VPN or corporate proxy — is rewriting it.
- Check you are hitting the right site. A 403 from phpMyAdmin and a 403 from your own site look identical.
- If the panel warns that the change was saved but not enforced, the proxy did not accept it. That is an operator problem, not yours — report it rather than retrying indefinitely.