It isn't that the codes are named wrongly. 401 Unauthorized means you don't have permission to access the page, whether you're authenticated or not. 403 Forbidden means you can never access the page, regardless of permissions. This is typical in multi-tenant setups or when a site is never accessible to unauthenticated users. The distinction is subtle but important, and developers often misuse these codes, serving 403 Forbidden for authorization issues instead of indicating a permanent block.