# 403 Forbidden opening a site from a cloud VM

A public page returning 403 from a cloud VM may be rejecting the network, but permissions, session state and browser checks can also cause it.

## Why it happens

A 403 means the server refused the request. Check whether the page needs a login or account permission before changing the network.

Compare the same public URL and relevant browser/session conditions. If the main difference is the network and the evidence points to a datacenter-IP rule, test a residential IP. A working home browser alone does not isolate the IP as the cause.

## When an IP change is worth testing

Aluvia is a local CLI and proxy daemon that routes your existing Chrome or Chromium browser through a residential IP. Use it when the evidence points to the request IP or the country the site sees. It cannot resolve ordinary login requirements or browser-signature restrictions.

Run setup on the browser's machine with Node.js 18 or later and a usable local Chrome or Chromium browser. A shell on another machine cannot configure it. Initial configuration can restart Chrome; save unfinished work first. [Runtime evidence and requirements](/compatibility).

## Start the 10 MB free trial

```sh
npx aluvia-cli setup
```

First 10 MB free. No account, API key or payment is required. Then 2 USD per GB. No target page URL is required. Follow the [quickstart](/docs) for result checks and undo.

## What the page says

Any of these is a string the page showed:

- "403 Forbidden"
- "HTTP 403"
- "Error 403"

## Check the setup result

Read the JSON response before continuing. `ready: true` confirms the local browser/proxy path and upstream check, not access to the target site. If setup needs recovery, follow `next` first. If `aluvia` is not on PATH, use `npx aluvia-cli` in later commands.

## Choose a country if the task needs one

Successful setup already enables proxy traffic through the global pool. If the page requires a country, list current availability before selecting it.

```sh
aluvia geos
```

## Select the required country

For example, use `US` only if the site needs that country and it appears in `aluvia geos`. Otherwise substitute the required available country. Skip this step when the global pool fits the task. Sticky sessions last up to 30 minutes. Country selection does not change GPS, timezone or Accept-Language.

```sh
aluvia proxy-on --geo US
```

## Reload and verify the page

Reload the same target URL in the configured browser. Check the actual page content, regional catalog or error message. Then inspect status; a ready proxy is not proof that the page is accessible or the task succeeded.

```sh
aluvia status
```

## If it is still blocked

For an IP-related refusal, try one rotation and reload. If the result does not change, stop and record the error for the operator. For rate limits, wait and reduce requests instead.

```sh
aluvia rotate-ip
```

## When this is the wrong tool

An account permission, missing login or browser-signature restriction needs its own remedy. A working home browser is a useful comparison, but differences in cookies or browser settings can also explain the result.

## Return to the original IP

After setup, switching IPs keeps Chrome running. Turn the proxy off when the task is finished or the IP change did not help.

```sh
aluvia proxy-off
```

## When the trial ends

If a command returns `payment_required`, show its actual `claim_url` to the operator. They choose whether to claim the account and buy data at 2 USD per GB. Then run `aluvia auth login` to wait and check the response before retrying. Never invent a claim link or reveal an API key. [Payment handoff](/e/payment_required).

## Related guide

[Identify a Cloudflare block](/unblock/cloudflare)

---

Source: https://aluvia.io/unblock/403