Fixing 403, 413 and 429 errors

Resolve 403 Forbidden, 413 Request Entity Too Large and 429 Too Many Requests on TurboStack: firewall blocks, upload size limits and TurboShield rate limiting.

A 4xx status code means the request was rejected before your application could serve it. The three you will see most on TurboStack each have a clear cause and a managed fix - a firewall block, a request that is too large, or rate limiting.

What each code means

Code	Name	What it usually means
403	Forbidden	Access is denied. On TurboStack this is typically a Firewall block, an allow-list miss on a restricted area, or file permissions.
413	Request Entity Too Large	The request body (usually a file upload) exceeds the configured size limit in PHP and/or the web server.
429	Too Many Requests	The client sent too many requests too quickly and was throttled by TurboShield rate limiting.

Symptoms

A specific visitor (or you) sees "403 Forbidden" while others are fine - a sign of an IP-level block or a restricted area.
Uploads fail with "413 Request Entity Too Large" once a file passes a certain size.
A client (or crawler/API) hits "429 Too Many Requests" during bursts of traffic, then recovers when it slows down.

403 Forbidden - access denied

Most 403s on TurboStack come from one of three places:

A Firewall block

If a whole IP address is blocked, every request from it returns 403. Check, then fix, over SSH:

# Is this address blocked?
tscli firewall check 203.0.113.10

# Restore access for a trusted address (office, monitoring, partner API)
tscli firewall whitelist 198.51.100.7

# Remove a block you no longer want
tscli firewall unblock 203.0.113.10

To make trust permanent, add the address to the host allow-list and publish - see Whitelist an IP address and Configure the Firewall. To block an abusive client, see Block an IP address.

Tip

GeoIP country rules can also produce 403s for legitimate visitors on VPNs or mobile networks. If a region is unexpectedly blocked, review the country rules on the host Security tab.

A restricted area or file permissions

A 403 limited to one path (for example an admin URL) is usually an intentional restriction - see Restrict admin access. A 403 across a whole site can instead be incorrect file or directory permissions for the web user; check the affected document root over SSH.

413 Request Entity Too Large - upload/body size limit

A 413 means the uploaded data is larger than the configured maximum. Two limits apply, and both must be large enough:

PHP - upload_max_filesize and post_max_size. Raise these through the PHP advanced options and publish; see Override PHP settings. Keep post_max_size at least as large as upload_max_filesize (it covers the whole request body, not just the file).
Web server - the web server also caps the request body size. On TurboStack the per-application vhost is generated for you (see Configure Nginx); if the web-server limit is the bottleneck after raising the PHP values, contact Support to adjust it.

Tip

Set the limits to the largest file you genuinely need to accept - not far beyond it. Very large bodies tie up workers and memory.

429 Too Many Requests - TurboShield rate limiting

A 429 on TurboStack is produced by TurboShield, the platform's web-traffic protection layer. When a client exceeds the allowed request rate, TurboShield returns a soft 429 - it is deliberately not a firewall ban, so a legitimate client recovers automatically once its request rate drops. See What is TurboShield?.

TurboShield runs at the host level with a single protection level:

Level	Behavior
`low`	Lenient limits; minimal bot controls.
`medium`	Balanced protection. This is the default.
`high`	Stricter limits and tighter bot controls.
`attack`	Most aggressive limits, for an active attack.

What to do:

Legitimate clients getting 429s (your own crawler, a partner API, monitoring): add them to the host IP allow-list so they bypass rate limiting - see the Security tab and Whitelist an IP address. If your level is too strict for normal traffic, lower it on the Security tab.
Abusive traffic causing the 429s is desirable: leave TurboShield on, and raise the level to high or attack temporarily while the incident lasts, then return to medium. Avoid running permanently at attack, which can throttle real visitors.

Prevent it

Keep monitoring and partner IPs on the host allow-list so they are never blocked or rate-limited.
Leave TurboShield at medium for typical workloads and only raise it during abuse - see Security hardening.
Set upload/body limits to match real requirements, and validate large uploads client-side before sending.

When to contact support

If a 403 persists after checking the firewall and permissions, if the web-server body limit blocks a legitimately large upload, or if TurboShield is throttling genuine traffic you cannot resolve with the allow-list, contact Support. Include the host and domain, the client IP, the exact error code, and what the client was doing.