I have a need to temporarily unpublish some pages on our website, but when anonymous users try to access an unpublished page, say they had it bookmarked, they get the message:

Access Denied

Which may sound too harsh. I thought about changing it to 'Page Not Found.'

However, I searched the entire site and I can't find any template that controls this particular message. Using Theme Developer, I can see that the Access Denied page is using the standard page.tpl.php, which I don't believe has anything pertaining to the Access Denied page. What am I missing?

  • 'Page Not Found' and 'Access Denied' are two different errors -- 404 and 403, respectively. Feb 22, 2017 at 20:46

3 Answers 3


For Drupal 7 & 8, you can set your access denied page and your page not found page easily. Go to /admin/config/system/site-information and review the error page section.

  • While this is true, it sounds like this posted wanted to swap the message - which is not possible (i.e. show 404 for a 403 for unpublished nodes). It may be technically feasible, but not a great idea.
    – Kevin
    Feb 22, 2017 at 20:48
  • If he creates a page, he can set any message he wants to, like 'Page not found' Feb 22, 2017 at 20:49
  • Except in the instance when it really isn't a 404, it would be really confusing if say there is an attached user component to this (like an extranet or light Drupal admin access).
    – Kevin
    Feb 22, 2017 at 20:50
  • 1
    Just understand that this is a global change, if you are getting 404 in the future while developing or accessing parts of the site, it might be a 403 in disguise.
    – Kevin
    Feb 22, 2017 at 20:54
  • 1
    lol what? Its just a message...
    – iLLin
    Feb 22, 2017 at 20:56

Assuming you are using Drupal 7. To find where the string comes from, you can go to your docroot and run grep -rnw . -e 'You are not authorized to access this page.' (You might need sudo permission).

I found it inside includes/common.inc at line 2729, under function drupal_deliver_html_page. That tells me I can try something like hook_page_delivery_callback_alter to modify the output in a custom module.

  • You should never modify core, as a general rule. Feb 22, 2017 at 20:50
  • 1
    I never meant to modify the core, I provided a way to find which hook to use in a custom module...
    – cchen
    Feb 22, 2017 at 20:51
  • 1
    grep will just find occurrences of the message string - he walked back the response by finding the calling function, which a hook is provided for to alter it before delivery. In fact, there is a comment here that illuminates a possible answer: api.drupal.org/comment/54353#comment-54353
    – Kevin
    Feb 22, 2017 at 20:52

you can use the hook_preprocess_page to alter your page. the code example below will help you. add it it to your template.php or custom module.

    function Hook_preprocess_page(&$vars) {
   global $user;       
     if ($vars['title'] == 'Access denied') {

            $normal_path = $_GET['q'];
            $parts=explode('/', $normal_path);
            $nid_part = $parts[1];
            $node = node_load($nid_part);
            if (!isset($node)) {
            if (($node->status == 0) &&
              ($node->nid == $nid_part) &&
              ($user->uid == 0)) {

simlar question : check this link

  • Hmm... to expand on this, this solution would not work if a node was titled 'Access denied' for whatever reason (short story entry on a site for budding authors, lets say), also, it assumes any authenticated role has unpublished node access. Also, you can get the node object either by node_load(arg(1)) or by $node = menu_get_object('node'); without looking at the raw GET parameters.
    – Kevin
    Feb 22, 2017 at 20:57
  • true that. well assuming that no one would create a node that is titled as 'Access Denied' in the website. you can use this code. alter it to your preferences. node->status=0 is to check if it's unpublished. by default Drupal will give 'Access denied' page for unpublished pages.
    – danuddara
    Feb 22, 2017 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.