The 403 page shows Access Denied and "Sorry, access to this store is currently restricted." It means your store is online, but one of your security rules blocked this visitor. The page never says which rule, so your store can work for one customer and show 403 to another. It is not the same as a 404 "Store not found" page, and it has nothing to do with the E-403 error when you add funds to your wallet.
Every reason a visitor sees the 403 page
- A banned IP address. Someone clicked Ban IP on an order, or Spy Blocker banned the visitor. An IP ban blocks everyone on that internet connection: a family, an office, or many phone users who share one mobile network address. This is the most common reason why some customers get 403 while others order normally.
- A banned device. Someone clicked Ban device on an order (needs Shield). The device stays blocked even on another connection.
- Access control. The visitor's country is not allowed by your whitelist or blacklist, their device type is not selected in Devices, or Block VPNs and proxies is on and their connection looks like a VPN or proxy. This check looks at the internet provider, so a customer can be flagged without using a VPN app, for example on a company network or a small provider.
- A deactivated domain. Everyone who opens your store on a domain set to Deactivated domain sees 403. Your other domains keep working.
- Shield blocklists. With Decoy mode off, a visitor whose browser matches a line in Blocked User-Agent keywords, or who arrived on a link that matches a line in URL parameters with the Blacklist method, sees 403. A URL parameter match stays for the rest of that visit, even on pages without the parameter. Ad links carry parameters, so a rule like this can block buyers who come from your own ads while people who type your address get in.
- Too many wrong codes. With Shield's Store entry captcha on, a visitor who types a wrong code many times in a short time sees 403 for a short while, then can try again.
What never shows a 403 page
- Shield's Max orders per customer. A customer over the limit can still open your store and every product. Only when they try to order do they see "You have placed several orders recently. Please wait a few hours before trying again", or a fake confirmation if Decoy mode is on. See test orders and the order limit.
- Duplicate orders blocker, WhatsApp validator, Checkout captcha, Minimum order placement delay, and URL parameters with the Whitelist method. They only act on the order.
- Anything while Decoy mode is on, for banned IPs, banned devices, and Shield blocklists. Those visitors see a normal store and a fake order confirmation instead.
- An unpublished store, or a product link that does not exist or is not sold in the visitor's country. Those show a 404 page.
Why you see it yourself
- You banned your own IP or device, for example while testing with an order you placed. Your IP ban also blocks everyone on your connection.
- Spy Blocker is on and banned you because you copied text or pressed a developer tools shortcut on your own store from a computer.
- Your country is not allowed by your country rules, your connection is flagged as a VPN or proxy, or your device type is not selected.
To find your own IP address, open Settings > Logins and look at the row marked This device.
How to find the cause and fix it
- Open Settings > Banned sessions. Look for your IP or the customer's IP (shown in their order), or their device. Click Release this ban. They can open your store again right away. See Logins and banned sessions.
- Open Settings > Access control. Check the Restriction Method, the Countries, the Devices, and Block VPNs and proxies, then click Save. See Access control.
- Open the Shield settings from Apps. Remove any line in Blocked User-Agent keywords or URL parameters that also matches real buyers, such as a common word or a parameter your own ads use, then click Save. See Shield.
- Open Settings > Domains. If the domain the customer used says Deactivated, click it and pick another type. See Custom domains.
If none of these match, ask the customer to try again later, from another connection, or with their VPN turned off.