Reddit's .json returns 403 in 2026. The RSS feeds still answer.

Every https://www.reddit.com/r/<sub>/new.json call I make today comes back
403. The RSS variant of the same path comes back 200. Both are public, both
are unauthenticated, and the difference is not documented anywhere I could find.

Here is what I measured on 2026-09-20, from a plain residential connection,
with curl and nothing else.

The numbers

URL	HTTP
www.reddit.com/r/python/new.json?limit=3, default curl UA	403
www.reddit.com/r/python/new.json?limit=3, Chrome UA	403
old.reddit.com/r/python/new.json?limit=3	302 (redirect to www)
www.reddit.com/r/python/new.rss?limit=3, Chrome UA	200, valid Atom
www.reddit.com/user/spez/.rss, Chrome UA	200, 35 KB

Two things fall out of that table.

The 403 is not about your User-Agent. This is the advice you will find in
most Stack Overflow answers about Reddit 403s, and on the .json endpoints it
no longer changes anything: a browser UA string gets the same 403 as the curl
default. Don't spend an afternoon rotating UA strings.

The .rss path is a different door. Same host, same subreddit, same
absence of credentials, and it answers with a well-formed Atom feed:

<?xml version="1.0" encoding="UTF-8"?>
<feed xmlns="http://www.w3.org/2005/Atom" ...>
  <category term="Python" label="r/Python"/>
  <updated>2026-09-20T16:25:21+00:00</updated>

The catch: 429 is not 403

The feed throttles, and it throttles fast. Five feed requests in a row from
the same IP and you start getting 429 Too Many Requests — including on paths
that answered 200 thirty seconds earlier.

That matters because it is easy to misread. In the same run I got:

• /r/python/comments/.rss → 429
• /user/spez/.rss → 200
• /search.rss?q=python → 429

If I had only tried the first one I would have written "comments feeds are
blocked". They are not. A 429 is a rate limit, not a verdict on the endpoint.
Space your probes out by a dozen seconds before you conclude anything about
what Reddit does or doesn't serve.

More generally: never conclude from an absence. If a check returns nothing,
prove your check can return something — send one request you know must fail
in a specific way, and make sure you get that specific failure back. If you
don't, you weren't talking to the thing you thought you were talking to.

What the feed gives you, and what it doesn't

You get: title, permalink, author, timestamp, and for comment feeds the
comment body as HTML inside <content>.

You don't get: score, upvote ratio, flair, num_comments, over_18, or any
of the other fields .json used to hand you. If your tool depends on those,
the RSS route won't save it. If you only need "what was posted, when, by whom,
linking where", it is enough.

Check it yourself

UA='Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 Chrome/128.0 Safari/537.36'
curl -s -o /dev/null -w '%{http_code}\n' -A "$UA" 'https://www.reddit.com/r/python/new.json?limit=3'
curl -s -o /dev/null -w '%{http_code}\n' -A "$UA" 'https://www.reddit.com/r/python/new.rss?limit=3'

If you need volume or the fields the feed drops, use the official API with
credentials — that is what it is for, and it is the honest door. The feeds are
for the small case: a handful of subreddits, polled slowly, read-only.

Measurements dated 2026-09-20. If they stop matching what you see, they have
expired — say so in the comments and I will re-run them.