Website returning 404 and not 403 for forbidden pages My site is returning a 404 error for users who have tried to access a restricted page. I understand that this can be seen as a useful security features, however, I would like to return a 403 error instead.

I note that drupal is recording "access denied" in the logs, but somehow this is getting converted to a 404 for the user.

I have tried changing theme to see if that helps, and had no success. I have also removed custom 404 and 403 pages but this did not help either.

Googling the problem found the following file, drupal/core/lib/Drupal/Core/Controller/ExceptionController.php. This does not seem to exist in my installation of drupal.

I am not confident (or competent!) at altering php files.

Any help that can be provided would be greatly appreciated, as I am at a loss on how to proceed.
I've found a workaround using the "redirect 403 to login" module. It is not yet in alpha for D8, but seems pretty stable.