A website hosted in Plesk for Windows Server is not accessible over HTTP, when “Require SSL/TLS” IIS setting is enabled: HTTP Error 403.4 – Forbidden

Symptoms

• When opening a website over HTTP in a web-browser, the following error is shown:

  Forbidden
  You do not have permission to access this document.

• When opening this website in a web-browser of Windows Server where the website is hosted, the error is:

  403.4 Forbidden The page you are trying to access is secured with Secure Sockets Layer (SSL).

  Module IIS Web Core
  Notification BeginRequest
  Handler ExtensionlessUrlHandler-Integrated-4.0
  Error Code 0x80070005
  Requested URL http://example.com:80/
  Physical Path C:Inetpubvhostsexample.comhttpdocs
  Logon Method Not yet determined
  Logon User Not yet determined

  More Information:
  This error means that the requested Web page requires SSL. Try to browse to the same URL, but use "https:" instead of "http:".

• The Require SSL/TLS option is enabled at Domains > example.com > IIS Settings.

Cause

The Require SSL/TLS option is enabled at Domains > example.com > IIS Settings.

Because of the Require SSL/TLS option, a web-browser forces HTTPS secure connection, but the website is served over HTTP and the 403 forbidden error is returned.

Resolution

To make the website accessible over HTTP, disable the Require SSL/TLS IIS option:

• in Plesk

  1. Log in to Plesk.

  2. Disable Require SSL/TLS option at Domains > example.com > IIS Settings > Directory Security Settings and apply the changes.

• in IIS Manager

  1. Connect to the Plesk server via RDP.

  2. Disable Require SSL option in IIS Manager at Sites > example.com > SSL Settings and apply the changes.