← Back to Wick

How to Fix 403 Forbidden in Claude Code

You're using Claude Code, and you ask it to read a webpage. API docs, a pricing page, a blog post, a news article. It tries:

Agent: I'll fetch that page for you.

Result: 403 Forbidden

Agent: I'm sorry, I wasn't able to access that page.
       The site appears to be blocking automated requests.

This happens dozens of times a day. Claude Code can write code, debug systems, manage git repos — but it can't read a webpage. Here's why, and how to fix it in 30 seconds.

Why Claude Code gets 403 errors

It's not about robots.txt. It's about TLS fingerprinting.

When Claude Code fetches a URL, it uses a standard HTTP client. Anti-bot systems like Cloudflare, Akamai, and Fastly inspect the TLS handshake — the very first message your connection sends — and compare it to known browser signatures.

Chrome's TLS handshake looks different from Go's, Python's, or Node's. The cipher suites, extensions, and their ordering create a unique fingerprint. Anti-bot systems identify non-browser clients in milliseconds, before the HTTP request even reaches the server.

That's your 403. The website never saw your request. The anti-bot layer killed it at the TLS level.

Sites that commonly block Claude Code:

The fix: Wick

Wick is a free, open-source MCP server that gives Claude Code browser-grade web access. It uses Chrome's actual network stack — the same BoringSSL, HTTP/2, and QUIC implementation that real Chrome uses. The TLS fingerprint is identical to a regular browser.

Install (30 seconds)

macOS:

brew tap wickproject/wick && brew install wick
wick setup

Linux:

curl -fsSL https://wickproject.github.io/wick/apt/install.sh | bash
wick setup

npm (any platform):

npm install -g wick-mcp
wick setup

wick setup auto-detects Claude Code and configures it. That's it.

Make Claude Code always use Wick

Add this to your project's CLAUDE.md:

When fetching web pages, always use the wick_fetch MCP tool instead of
the built-in WebFetch tool. wick_fetch bypasses anti-bot protection and
returns cleaner content. Use wick_search for web searches.

Now when Claude Code needs to read a webpage, it reaches for wick_fetch instead of its built-in fetch that gets blocked.

What Wick returns

Instead of a 403 error, your agent gets clean markdown:

Agent: I'll fetch that article using wick_fetch.

# The New York Times - Breaking News

Led by the freshman forward Cameron Boozer,
the No. 1 overall seed faces a tough test in
the NCAA tournament...

Clean, structured content your agent can actually reason about. Not raw HTML, not a wall of <div> tags — markdown with headings, links, and paragraphs.

How it works

Wick runs as a local MCP server on your machine. When Claude Code calls wick_fetch:

  1. The request goes through Chrome's actual network stack
  2. The TLS fingerprint matches a real Chrome browser
  3. The request exits from your residential IP (not a datacenter)
  4. Anti-bot systems see a normal browser visit
  5. The HTML response is extracted into clean markdown
  6. Claude Code gets the content

No cloud service. No proxy. No API key. Everything runs locally.

What about sites that need JavaScript?

Some sites (Reddit, SPAs, financial exchanges) require JavaScript to render content. The free tier handles most of the web, but for JS-heavy sites, Wick Pro ($20/month) adds a full browser engine that renders JavaScript, handles CAPTCHAs automatically, and bypasses even aggressive anti-bot systems.

Run wick pro activate to upgrade. The free tier automatically detects when Pro would help and suggests it.

Quick reference

ProblemSolution
403 ForbiddenInstall Wick: brew install wick && wick setup
Claude uses built-in fetchAdd CLAUDE.md instructions (see above)
JS-rendered pages blankwick pro activate for JS rendering
robots.txt blockingwick fetch URL --no-robots
Need raw HTMLwick fetch URL --format html

Links


Wick is built by Adam Fisk, creator of Lantern — a censorship circumvention tool used by 150 million people in Iran, China, and Russia. The same techniques that bypass government censors now bypass anti-bot walls.