Unless I'm missing something, you don't send any visible response. You're just sending the header which the browser does not render. If you read 404 to Apache, it was stated that Apache ignores the result code from CGI it will not actually return the 403 page. Apache just sends the response code along. You need to find the page from the config and return it yourself.