Google says it is best not to use a 403 server status code and if you are, to switch it to use a 404 server status code instead. Google's John Mueller said on Twitter that a 403 is "weird" but it should ultimately lead to the pages being removed. It is best to just switch the 403s to 404s because those do the job better.
John said "403 is a bit weird but should drop the pages too. I'd clean it up normally with 404 though, don't add a hack when the real solution is just as easy."
403 is a bit weird but should drop the pages too. I'd clean it up normally with 404 though, don't add a hack when the real solution is just as easy.
— John ☆.o(≧▽≦)o.☆ (@JohnMu) May 2, 2018
W3's definition of a 403:
10.4.4 403 Forbidden:The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. If the server does not wish to make this information available to the client, the status code 404 (Not Found) can be used instead.
Google warned once before about misuse of 403s on your site.
Forum discussion at Twitter.
