NOTE: This post is relevant for the Apache-based servers. For IIS-based servers, see https://handyman.dulare.com/http-status-403-forbidden-after-coldfusion-upgrade/
I noticed that this issue occurs on ColdFusion 2016 and 2018 after the ColdFusion server update. The symptoms are rather strange:
HTTP Status 403 – Forbidden. And – it comes from Tomcat, not the Apache server itself.
The connector-based solution
The first thing to do is to update the connector between Apache and ColdFusion. This is a must-have for most of the ColdFusion updates nowadays.
On Linux, it is rather simple. Find your wsconfig application (it is typically located in:
and you can simply run:
The connector is upgraded but the site still shows 403
If the site is still not working, try to remove .htaccess file for a while (or rename it). If the error is gone, it means that you have an additional issue, which is related to the headers sent to Tomcat.
Most likely, you have a rule in your .htaccess file that comes with the “.*” expression. This leads to the issue with Tomcat server.
In such a case, locate server.xml file which is typically located here:
In the file, find the line that starts with:
<Connector connectionTimeout="60000" maxThreads="100"
And inside this configuration line add this statement:
As the last step, save the file and restart ColdFusion server. It should now work properly.