How to fix 0x80244018 (HTTP 403 forbidden) in Windows Update
This means something between your PC and the update server understood the request but refused it, an HTTP 403. The usual culprit is a proxy, firewall or web filter. Jump to your situation below or work through the methods in order.
By Neeraj Singh ~7 min Updated Jun 2026 89% found this helpful
Error message
0x80244018 WU_E_PT_HTTP_STATUS_FORBIDDEN. The server understood the request but declines to fulfill it (HTTP 403).
Summary
0x80244018 (WU_E_PT_HTTP_STATUS_FORBIDDEN) is an HTTP 403 on the update connection: a server, or something acting on its behalf, understood the request and refused it. The connection itself works, so this is not a name-resolution problem like 0x8024402C, it is something blocking the request. The usual culprits are a proxy server, a firewall, a web filter or a security product sitting between the PC and the update hosts, or a stale WinHTTP proxy setting pointing at the wrong place. On a managed network it can be a policy that denies the device. The fix is to reset the WinHTTP proxy, allow the Microsoft update hosts through the proxy and firewall, temporarily disable a blocking security product to test, and check any WSUS or proxy policy.
What this error means
An HTTP 403 means the request reached a server and was understood, but the server, or a proxy or filter in the path, declined to fulfill it. For Windows Update that almost always means something is deliberately blocking access to the update endpoints, not that the endpoints are down.
So unlike a connection or name-resolution error, the network is working, the request is just being refused. The thing doing the refusing is usually a proxy, firewall, web filter or security product, or a stale WinHTTP proxy that routes the request somewhere that rejects it. Clearing or allowing that path resolves it.
Common causes
A proxy server refuses the update request with a 403.
A firewall or web filter blocks the update hosts.
A security product intercepts and blocks the connection.
A stale or wrong WinHTTP proxy setting routes the request badly.
A WSUS or proxy policy denies the device access.
The network requires proxy authentication that is not satisfied.
The Microsoft update hosts are not on the allow list.
Expert insight
“A 403 is different from a connection error, the request got there and was told no. So I stop looking at the network and start looking at what is in the way. Most often it is a stale WinHTTP proxy pointing at a server that rejects the request, so I reset it. After that it is the usual suspects, a firewall, a web filter, or a security product blocking the update hosts. Allow those hosts through, and the 403 turns into a successful download.”
Manager, Tech Support & Operations · 19+ years fixing Windows and system errors
✓ How to fix it
Method 1
Reset the WinHTTP proxy
1From an elevated Command Prompt, clear the proxy Windows Update uses:
netsh winhttp reset proxy
2Then check it is clear: netsh winhttp show proxy.
3A stale proxy is the most common cause, so try this first.
Method 2
Set the proxy correctly
1If your network needs a proxy, import the working browser proxy:
netsh winhttp import proxy source=ie
2Check Settings, Network and internet, Proxy matches your network.
3Then retry.
Method 3
Allow the update hosts
1Allow the Microsoft update hosts through the proxy, firewall and web filter.
2If you do not know the list, allow the standard Windows Update endpoints documented by Microsoft.
3Then retry the update.
Method 4
Test without a security product
1Temporarily disable or uninstall a third-party security or web-filtering product.
2If the update then works, add the update hosts as an exception and re-enable it.
3Some products block update traffic by default.
Method 5
Check WSUS and proxy policy
1On a managed PC, a WSUS or proxy Group Policy may deny the device.
2Verify the device is permitted, or ask your administrator.
3A policy 403 is resolved on the server side.
Method 6
Reset Windows Update components
1If the path is clear but it still fails, reset the update components and clear the cache.
2Restart the services and retry.
A 403 means the request was refused, not that the network is down, so look for what is blocking rather than for a connection fault. Reset the WinHTTP proxy first since a stale proxy is the most common cause, then make sure the proxy, firewall and any security product allow the Microsoft update hosts.
Frequently asked questions
What does error 0x80244018 mean?
WU_E_PT_HTTP_STATUS_FORBIDDEN is an HTTP 403: the update request reached a server and was understood, but was refused. Something, usually a proxy, firewall or filter, is blocking it.
How is this different from 0x8024402C?
0x8024402C means the server name could not be resolved, a connection problem. 0x80244018 means the connection works but the request was refused with a 403, a blocking problem.
How do I reset the WinHTTP proxy?
From an elevated prompt run netsh winhttp reset proxy, then confirm with netsh winhttp show proxy. A stale proxy is the most common cause, so try this first.
Could my antivirus cause it?
Yes. A security or web-filtering product can block update traffic and return a 403. Temporarily disable it to test, then add the update hosts as an exception.
Why do I get this on a work PC?
A WSUS or proxy Group Policy may deny the device, or the proxy requires authentication. Verify the device is permitted, or ask your administrator to allow it.
What hosts do I need to allow?
Allow the standard Microsoft Windows Update endpoints through your proxy, firewall and web filter. Microsoft documents the required hosts for update connectivity.
Still not working?
If the proxy is reset and the hosts are allowed but the 403 continues, a transparent proxy or HTTPS-inspection appliance on the network is likely refusing the request. On a managed network this needs the network team to allow the update hosts through inspection. You can also submit your error to us for a tailored fix.
