A 401 Unauthorized means the server does not know who you are. You either sent no login details, or the ones you sent were wrong.
What to do
- Check the username and password you are using. A trailing space when you paste is the usual culprit.
- If you are using an API key or token, check it has not expired. Tokens stop working after a while.
- Try the site’s homepage. If that loads fine and only one page gives a 401, that page is password-protected on its own.
- If it is your own site, look for a password on the folder. On Apache that is a
.htpasswdfile. On nginx it is a line sayingauth_basic.
401 or 403?
| 401 | The server does not know who you are. Log in and try again. |
| 403 | The server knows who you are and you are not allowed. Trying again will not help. |
Why it happens
- The page or folder has a password on it
- A test or staging site was password-protected and never unlocked
- An API token has expired
- A key was copied wrong, or a character got lost
- A security plugin is blocking the request
One thing worth knowing
FTP errors are not 401s. FTP uses its own numbers, so a failed FTP login gives you a 530, not a 401. If you see a 401 while moving files, something else is making a web request in the background and failing.