Unable to reach Home Assistant Cloud - 403 forbidden – Nabu Casa Support

There are multiple reasons Home Assistant Cloud cannot be reached. This page provides instructions how to troubleshoot when you see the "403 Forbidden" message.

Message: 403 Forbidden

Symptom

You are using remote access feature. Instead of the Home Assistant user interface, the browser shows a 403 Forbidden message.

Cause

403 Forbidden indicates that IP banning is enabled on your Home Assistant system and that the address you are connecting from has been banned. A ban blocks every request from that address, not just the login page.

Which address was banned depends on your Home Assistant version:

Home Assistant 2026.9 or newer: Home Assistant Cloud remote access forwards the real IP address of the incoming request, so the banned entry is the address you were connecting from at the time. If you were on mobile data, this is an address belonging to your mobile provider.
Home Assistant 2026.8 or older: Home Assistant Cloud remote access did not forward the IP address of the incoming request. Every visitor arriving through the Cloud tunnel appeared as 127.0.0.1, so a single failed login from anywhere banned every remote connection at once. If you see this, we recommend updating to Home Assistant 2026.9 or newer.

Resolution

You need access to your configuration folder to remove a ban. If you cannot reach Home Assistant at all, use a local network connection, the File editor add-on from a device on your home network, or a Samba or SSH connection.

In your configuration folder, open the ip_bans.yaml file.
Delete the entry for the banned address, including its banned_at line.
```
198.51.100.24:
  banned_at: '2026-08-17T14:20:03.000000+00:00'
```
- To clear all bans, delete the whole file. Home Assistant recreates it the next time an address is banned.
- If you have upgraded to Home Assistant 2026.9 or newer and still see a 127.0.0.1 entry, it is left over from before the upgrade. It no longer refers to remote visitors and on most systems blocks nothing, but it is worth removing.
Save the file and restart Home Assistant to apply the changes.

Prevention

Bans are triggered by the Login attempts before ban setting under Settings > System > Network. If you are being banned more often than you expect, the threshold is probably set too low: Home Assistant counts failed attempts per address with no time limit, and counts any request with invalid authentication, not just mistyped passwords.

Note:

On Home Assistant 2026.7 or earlier, these options are not in the user interface. IP banning was set up in your configuration.yaml file instead, using ip_ban_enabled and login_attempts_threshold under http:.

For guidance on choosing a threshold, see Remote access - limitations.

Edit this article on GitHub