The logs of the webserver you are using.
You are using Apache webserver, but although you are using nginx as just a reverse proxy, per si nginx can return code "403" too.
So, I would recommend all of these logs, in this order:
=================================
1) /usr/local/apache/domlogs/domain.error.log
2) /usr/local/apache/domlogs/domain.log
3) /usr/local/apache/logs/error_log
4) /usr/local/apache/logs/access_log
5) /var/log/nginx/error.log
6) /var/log/nginx/access.log
=================================