Feed download with 403 error

[AlephArgo]

Dear Watcher development team,
I've got many "Error: Status code: 403" from feeds:

watcher     | 2025-12-24T06:30:04.891329595Z WARNING 2025-12-24 07:30:04,887 | Feed: https://www.exabeam.com/feed/ => Error: Status code: 403
watcher     | 2025-12-24T06:30:06.393776888Z WARNING 2025-12-24 07:30:06,390 | Feed: https://www.cylance.com/rss/GlobalCylanceThreatReport => Error: Status code: 403
watcher     | 2025-12-24T06:30:20.759765123Z WARNING 2025-12-24 07:30:20,756 | Feed: https://blog.qualys.com/feed => Error: Status code: 403
watcher     | 2025-12-24T06:30:43.379820336Z WARNING 2025-12-24 07:30:43,374 | Feed: https://blog.sucuri.net/feed => Error: Status code: 403
watcher     | 2025-12-24T06:30:45.407715985Z WARNING 2025-12-24 07:30:45,402 | Feed: https://heimdalsecurity.com/blog/feed/ => Error: Status code: 403
watcher     | 2025-12-24T06:30:57.618065627Z WARNING 2025-12-24 07:30:57,603 | Feed: https://www.silicon.co.uk/category/security/feed => Error: Status code: 403
watcher     | 2025-12-24T06:31:07.849078191Z WARNING 2025-12-24 07:31:07,837 | Feed: https://www.empowerelearning.com/blog/feed/ => Error: Status code: 403
watcher     | 2025-12-24T06:31:09.267182603Z WARNING 2025-12-24 07:31:09,262 | Feed: https://www.canarytrap.com/feed/ => Error: Status code: 403
watcher     | 2025-12-24T06:31:14.391469169Z WARNING 2025-12-24 07:31:14,387 | Feed: https://www.idsalliance.org/feed/ => Error: Status code: 403
watcher     | 2025-12-24T06:31:30.390784883Z WARNING 2025-12-24 07:31:30,385 | Feed: https://www.cyberdb.co/blog/?utm_source=feedspot => Error: Status code: 403
watcher     | 2025-12-24T06:31:50.094704361Z WARNING 2025-12-24 07:31:50,090 | Feed: https://www.datasecuritybreach.fr/feed/ => Error: Status code: 403
watcher     | 2025-12-24T06:31:50.623491690Z WARNING 2025-12-24 07:31:50,619 | Feed: https://www.undernews.fr/feed => Error: Status code: 403
watcher     | 2025-12-24T06:32:27.375628714Z WARNING 2025-12-24 07:32:27,364 | Feed: https://www.bleepingcomputer.com/feed/ => Error: Status code: 403
watcher     | 2025-12-24T06:32:32.043277505Z WARNING 2025-12-24 07:32:32,036 | Feed: https://www.phishlabs.com/feed/ => Error: Status code: 403
watcher     | 2025-12-24T06:32:40.318240325Z WARNING 2025-12-24 07:32:40,310 | Feed: https://www.weforum.org/agenda/cybersecurity/feed/ => Error: Status code: 403
watcher     | 2025-12-24T06:32:58.891440611Z WARNING 2025-12-24 07:32:58,887 | Feed: https://adamlevin.com/feed/ => Error: Status code: 403
watcher     | 2025-12-24T06:32:59.335516208Z WARNING 2025-12-24 07:32:59,329 | Feed: https://www.tripwire.com/state-of-security/feed/ => Error: Status code: 403
watcher     | 2025-12-24T06:33:21.236232356Z ERROR 2025-12-24 07:33:21,234 | HTTPSConnectionPool(host='www.cyber.gov.au', port=443): Read timed out. (read timeout=10)
watcher     | 2025-12-24T06:33:24.135570546Z WARNING 2025-12-24 07:33:24,126 | Feed: https://cio.economictimes.indiatimes.com/rss/internet => Error: Status code: 403
watcher     | 2025-12-24T06:33:24.691297242Z WARNING 2025-12-24 07:33:24,687 | Feed: https://cio.economictimes.indiatimes.com/rss/data-center => Error: Status code: 403
watcher     | 2025-12-24T06:33:25.105259042Z WARNING 2025-12-24 07:33:25,102 | Feed: https://cio.economictimes.indiatimes.com/rss/digital-security => Error: Status code: 403
watcher     | 2025-12-24T06:33:25.504982158Z WARNING 2025-12-24 07:33:25,490 | Feed: https://cio.economictimes.indiatimes.com/rss/next-gen-technologies => Error: Status code: 403
watcher     | 2025-12-24T06:33:28.891350618Z ERROR 2025-12-24 07:33:28,889 | HTTPSConnectionPool(host='www.homelandsecuritynewswire.com', port=443): Max retries exceeded with url: /topics/cybersecurity (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1016)')))
watcher     | 2025-12-24T06:33:30.778447278Z WARNING 2025-12-24 07:33:30,775 | Feed: https://www.securityweek.com/rss => Error: Status code: 403
watcher     | 2025-12-24T06:33:33.478454753Z WARNING 2025-12-24 07:33:33,473 | Feed: https://www.govinfosecurity.com/rss-feeds => Error: Status code: 429
watcher     | 2025-12-24T06:33:33.887038813Z WARNING 2025-12-24 07:33:33,881 | Feed: https://www.cyberdefensemagazine.com/feed/ => Error: Status code: 403
watcher     | 2025-12-24T06:33:34.626404679Z WARNING 2025-12-24 07:33:34,621 | Feed: https://www.securityweek.com/feed/ => Error: Status code: 403

I tried to download some of them with wget after connecting to the watcher container, and I'm able to downlad some while I get a 403 error with others.

For instance:

• https://blog.sucuri.net/feed : feed downloaded
• https://www.exabeam.com/feed/: : feed downloaded
• https://blog.qualys.com/feed: feed downloaded

How can I solve this?

Thanks for your attention
Kind regards
stefano

[ygalnezri]

Hi @AlephArgo,

Thanks for your report and for the detailed examples, very helpful.

Some feeds return a 403 Forbidden when Watcher tries to fetch them without a proper User-Agent. As you noticed with wget, some sites block default clients and expect requests that look like a regular browser.

We updated core.py to make feed fetching more reliable. Watcher now sends browser-like headers including User-Agent and Accept-Language for both RSS feed retrieval and redirect handling. SSL handling is also adjusted to prevent failures on endpoints with stricter configurations.

Most feeds should now work correctly. For example, feeds like https://www.bleepingcomputer.com/feed/ or https://blog.sucuri.net/feed/ now work properly in Watcher. Some sites may still return 403 due to advanced bot protections or rate limits, this is expected and cannot always be bypassed with headers only.

These improvements are included in the upcoming Watcher 3.2.3 release, which also fixes several other bugs detected in previous versions to improve overall stability.

Thanks again for reporting this, it really helps us make Watcher more robust.

Kind regards,
Ygal

[ygalnezri]

Hi @AlephArgo,

You identified the issue correctly: some feeds return a 403 Forbidden when Watcher attempts to fetch them without a proper User-Agent. As you observed with wget, certain websites block default clients and expect requests that resemble a regular browser.

This has now been fixed in the latest release v3.3.0: https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.3.0

Watcher now sends browser-like headers (including User-Agent and Accept-Language) for both RSS retrieval and redirect handling. SSL behavior has also been improved to reduce failures on endpoints with stricter configurations.

Feeds such as https://www.bleepingcomputer.com/feed/ and https://blog.sucuri.net/feed/ should now work correctly. Please note that some websites may still return 403 due to advanced bot protections or rate limits, this is expected and cannot always be bypassed with headers alone.

Please pull the latest Docker image and follow the update steps in the release notes; this should resolve the behavior entirely.

Thanks again for reporting this.

Kind regards,
Ygal