home / website errors / 401-unauthorized

[ REPAIR GUIDE ] WEBSITE ERRORS

How to fix a 401 Unauthorized error

ERROR DETECTED >401 Unauthorized

UPDATED NOVEMBER 20263 MIN READ8 FIXES

QUICK FIX

Sign out of the site, delete its cookies, then sign in again with the correct username and password. If you know your details are right and it still fails, contact the site.

What it means

A 401 Unauthorized error means the page needs you to prove who you are, and the server did not get valid login details. You either are not signed in, typed the wrong username or password, or your saved session expired. It is often fixable by the visitor by signing in again, but if correct details keep failing, the site owner needs to check its login setup.

Common causes

  • You are not signed in, or your session expired
  • Wrong username or password, or Caps Lock is on
  • Old or corrupted login cookies for that site
  • An outdated bookmark to a members-only or admin page
  • A password-protected folder on the server
  • On the site's side, a broken login plugin, expired API key or wrong authentication settings

How to fix it

Work down the list. Each fix is safe to try before moving on to the next.

FIX 01Check the address and sign inEASY

  1. Check the URL is correct and not an old bookmark.
  2. Go to the site's home page and use its Sign in or Log in link.
  3. Check that Caps Lock is off and that you are using the right account.

Why it helps: A 401 most often just means the server has not received valid login details.

FIX 02Reset your passwordEASY

  1. On the sign-in page, choose the site's Forgot password option.
  2. Follow the email link to set a new password.
  3. Sign in with the new password.

Why it helps: If your saved password is outdated, a reset gives you working details.

FIX 03Delete the site's cookies and sign in againEASY

  1. In Chrome, open the three-dot menu and choose Settings.
  2. Go to Privacy and security > Third-party cookies > See all site data and permissions.
  3. Search for the site, click the trash icon and confirm with Delete.
  4. Reload the page and sign in again.

Why it helps: An expired or corrupted session cookie can keep sending login details the server rejects.

FIX 04Try a private window or another browserEASY

  1. Open an Incognito window with Ctrl + Shift + N on Windows or Command + Shift + N on a Mac.
  2. Go to the site and sign in there.
  3. If it works, remove the site's saved data in your normal browser and turn off extensions one at a time to find a conflict.

Why it helps: This rules out stored data and extensions in your usual browser profile.

FIX 05Contact the siteEASY

  1. If correct details fail in every browser, contact the site's support.
  2. Tell them the page address, the time and that you received a 401 error.

Why it helps: Your account may be locked or the site's login system may be broken.

// RUN THIS SITE? FIXES FOR SITE OWNERS

FIX 06Check password-protected foldersMEDIUMSITE OWNERS

  1. In cPanel, open Directory Privacy and see whether the folder is password protected.
  2. Check .htaccess in that folder and its parents for AuthType and Require lines you did not expect.
  3. Make sure the password file named by AuthUserFile exists and contains the user.
  4. Remove or update the protection if it was added by mistake, for example on wp-admin by a security tool.

Why it helps: Server-level password protection sends a 401 before your site's own login ever runs.

FIX 07Test login plugins and security rulesMEDIUMSITE OWNERS

  1. Check your server error log at the time of the 401.
  2. On WordPress, temporarily disable security, login or membership plugins by renaming their folders in wp-content/plugins.
  3. Test the login again, then restore the folders one at a time to find the cause.
  4. Check firewall or CDN rules that may require authentication on certain paths.

Why it helps: A misconfigured plugin or rule can reject valid logins.

FIX 08Check API keys and IIS authenticationADVANCEDSITE OWNERS

  1. For APIs, confirm the token or key has not expired and is sent in the Authorization header in the format the server expects.
  2. Look at the WWW-Authenticate header in the 401 response to see which authentication scheme the server wants.
  3. On IIS, open the page in a browser on the server itself to see the detailed error with its substatus code (401.1 to 401.5 are not written to the IIS log): 401.1 means bad credentials, 401.2 means server authentication settings, and 401.3 means file or folder permissions.
  4. In IIS Manager, open Authentication for the site and make sure the intended methods are enabled.

Why it helps: The response headers and IIS substatus codes point straight to which part of authentication failed.

Check it's fixed

  • You can sign in and reach the page you wanted.
  • The page still loads after closing and reopening the browser.
  • API requests return a 2xx status with the current token.

When to get help

If correct details fail everywhere, contact the site, since your account may be locked. Site owners who cannot find the cause should contact their host or the developer of the login or security plugin.

Questions

What is the difference between 401 and 403?

A 401 means the server does not know who you are yet, so signing in may fix it. A 403 Forbidden means it knows who you are but you do not have permission, and signing in again will not help.

Why does a sign-in box pop up before the page?

The folder is protected by the web server itself. You need the separate username and password set up for it, not your normal site account.

Is a 401 a problem with my internet connection?

No. Your connection reached the site fine; the site simply did not accept your login details for that page.

Related fixes

How to fix 400 Bad Request (and Request Header or Cookie Too Large)Delete the cookies for that one website and reload the page. If that does not work, check the address for typos or extra characters and openHow to fix 405 Method Not AllowedAs a visitor, go back to the site's home page and repeat the action from there instead of refreshing or using the back button. As a sitHow to fix ERR_TOO_MANY_REDIRECTSDelete the cookies for that site and reload. If it still loops on every browser and device, the site has a redirect loop that the owner mustHow to fix HTTP error 500 (500 Internal Server Error)If you are visiting the site, refresh after a minute or two and try again later; the fault is on the server. If you own the site, check the

Still stuck?

Paste the exact message and the repair bot will find the closest fix, or search it on Google, Microsoft, Apple, Reddit and YouTube.

Sources