HTTP Status Codes

Look up any HTTP status code in seconds. Search by number or keyword, filter by class, and open an entry for its meaning, typical causes and how to fix the common errors.

100% freeNo sign-upRuns in your browserWorks on mobile

1xx Informational

100Continue The server received the request headers; the client can send the body.

Sent in reply to a request with an Expect: 100-continue header, so a client can check that a large upload will be accepted before sending it. Browsers and HTTP libraries handle it automatically.

Defined in RFC 9110.

101Switching Protocols The server agrees to switch to the protocol named in the Upgrade header.

Most often seen when a connection is upgraded from HTTP/1.1 to WebSocket. After this response the connection speaks the new protocol.

Defined in RFC 9110.

102Processing The server accepted the request but has not finished it yet.

An interim WebDAV response meant to stop long operations from timing out. Later WebDAV specifications dropped it, and it is rarely used today.

Defined in RFC 2518 (WebDAV).

103Early Hints Preliminary headers, usually preload links, sent before the final response.

Lets the browser start downloading CSS, fonts or scripts while the server is still building the page, which can improve load times. Supported by modern browsers and several CDNs.

Defined in RFC 8297.

2xx Success

200OK The request succeeded.

The standard success response. For GET the body contains the requested resource; for POST it usually describes the result of the action.

Defined in RFC 9110.

201Created The request succeeded and a new resource was created.

The typical reply to a POST or PUT that creates something. The Location header should point to the new resource.

Defined in RFC 9110.

202Accepted The request was accepted, but processing has not finished.

Used for asynchronous work such as queued jobs or batch imports. The response often includes a URL where the client can check progress later.

Defined in RFC 9110.

203Non-Authoritative Information Success, but a transforming proxy modified the response.

Indicates that the content came from a proxy that changed the origin server’s original 200 response. Rarely seen in practice.

Defined in RFC 9110.

204No Content Success, with no response body.

Common for DELETE requests, autosaves and CORS preflight replies, where the client needs no data back. A 204 response must not include a body.

Defined in RFC 9110.

205Reset Content Success; the client should reset the form or view that sent the request.

Tells the client to clear the document view, for example to empty a form after submission. Rarely used.

Defined in RFC 9110.

206Partial Content Only the requested byte range is being sent.

The reply to a request with a Range header. It powers resumable downloads and seeking in audio and video files.

Defined in RFC 9110.

207Multi-Status The body contains separate status codes for several operations.

Used by WebDAV when one request acts on many resources, such as copying a folder. The XML body lists the outcome for each.

Defined in RFC 4918 (WebDAV).

208Already Reported These members were already listed earlier in the same response.

Prevents a WebDAV binding from being listed repeatedly inside a Multi-Status response.

Defined in RFC 5842 (WebDAV).

226IM Used The server applied instance manipulations, such as a delta, to the response.

Part of HTTP delta encoding, which sends only the changes since a previous version. Very rarely implemented.

Defined in RFC 3229.

3xx Redirection

300Multiple Choices Several representations are available and the client may choose one.

For example the same document in different formats or languages. Browsers do not choose automatically, so it is rarely used.

Defined in RFC 9110.

301Moved Permanently The resource has a new permanent URL, given in the Location header.

Search engines pass ranking signals to the new URL and replace the old one in their index, and browsers may cache the redirect for a long time. Clients have historically changed a POST into a GET when following it; use 308 if the method must be kept.

Good practice: Use it for domain moves, HTTPS migrations and changed URLs. Redirect each old URL to its closest new equivalent, not everything to the home page, and avoid chains of several redirects.

Defined in RFC 9110.

302Found The resource is temporarily available at another URL.

Search engines normally keep the original URL in their index. Like 301, clients usually change POST to GET when following it; 307 keeps the method.

Good practice: Use it only for genuinely temporary moves, such as A/B tests or a short promotion. If the move is permanent, switch to 301 or 308.

Defined in RFC 9110.

303See Other Fetch the result from another URL using GET.

Often sent after a form POST to redirect to a confirmation page (the Post/Redirect/Get pattern), so refreshing the page does not submit the form twice.

Defined in RFC 9110.

304Not Modified The cached copy is still valid, so no body is sent.

The reply to a conditional request with If-None-Match or If-Modified-Since. It saves bandwidth and shows caching is working; it is not an error.

Defined in RFC 9110.

305Use Proxy Deprecated: the resource had to be accessed through a proxy.

Deprecated for security reasons, and browsers ignore it.

Defined in RFC 9110 (deprecated).

306(Unused) Reserved; once meant Switch Proxy and is no longer used.

The code is kept reserved so it is never reassigned.

Defined in RFC 9110 (reserved).

307Temporary Redirect Temporarily at another URL; repeat the same method and body there.

Like 302, but guarantees that a POST stays a POST. Browsers also show an internal 307 when HSTS upgrades an http:// link to https://.

Defined in RFC 9110.

308Permanent Redirect Permanently moved; repeat the same method and body at the new URL.

The method-preserving equivalent of 301. Search engines treat it like a 301 permanent redirect.

Defined in RFC 9110.

4xx Client errors

400Bad Request The server could not understand the request.

A generic client error for requests that are malformed or invalid.

Common causes: Malformed JSON or XML, missing required parameters, unencoded special characters in the URL, corrupted or oversized cookies, or a body that does not match the API’s expected format.

How to fix it: Validate the body against the API documentation, URL-encode parameters, and if a browser shows it on every page of one site, clear that site’s cookies.

Defined in RFC 9110.

401Unauthorized Authentication is required, or the credentials were rejected.

Despite the name it means “unauthenticated”. The response includes a WWW-Authenticate header that says how to authenticate.

Common causes: A missing Authorization header, an expired or malformed token, a wrong API key, or a session that timed out.

How to fix it: Log in again or refresh the token, check the header name and scheme (for example Authorization: Bearer …), and make sure the key belongs to the right environment. A JWT decoder shows whether a token has expired.

Defined in RFC 9110.

402Payment Required Reserved for future use; some APIs use it when payment is needed.

Never standardized for a specific purpose. Some services return it when a subscription has lapsed or a usage quota needs a paid plan.

Defined in RFC 9110 (reserved).

403Forbidden The server knows who you are but refuses access.

Unlike 401, logging in again will not help: the account or client lacks permission, or the server blocks the request outright.

Common causes: Missing roles or permissions, restrictive file permissions on the server, IP blocks or firewall rules, a directory without an index file when listing is disabled, or a failed CSRF check.

How to fix it: Check the account’s permissions, file and folder permissions (commonly 644 for files and 755 for folders; see the chmod calculator), web server allow and deny rules, and security plugin or firewall logs.

Defined in RFC 9110.

404Not Found Nothing exists at this URL.

The most familiar error. It says nothing about whether the resource ever existed or might exist later.

Common causes: A mistyped or outdated link, a page deleted or moved without a redirect, wrong letter case on a case-sensitive server, or a routing rule that does not match.

How to fix it: Fix broken internal links, add 301 redirects from old URLs to their replacements, and serve a helpful custom 404 page with search and navigation. For APIs, check the path and the resource ID.

Defined in RFC 9110.

405Method Not Allowed The URL exists but does not accept this HTTP method.

The response must include an Allow header listing the methods that are supported.

Common causes: Sending POST to an endpoint that only handles GET, a missing route for PUT or DELETE, or a static file server that rejects POST.

How to fix it: Read the Allow header and use one of the listed methods, or add the missing route on the server.

Defined in RFC 9110.

406Not Acceptable The server cannot produce a format that matches the Accept headers.

Content negotiation failed: for example the client accepts only XML and the server can only send JSON.

Defined in RFC 9110.

407Proxy Authentication Required A proxy between you and the server needs credentials.

Works like 401 but for a proxy, which sends a Proxy-Authenticate header. Common on corporate networks.

Defined in RFC 9110.

408Request Timeout The server gave up waiting for the client to finish sending the request.

The server closes the connection because the request did not arrive in time.

Common causes: Slow or unstable connections, very large uploads, or idle keep-alive connections that the server closes.

How to fix it: Retry the request. For uploads, check the network or raise the server’s request timeout.

Defined in RFC 9110.

409Conflict The request conflicts with the current state of the resource.

Typical when two people edit the same record or when creating something that already exists.

Common causes: Concurrent edits, duplicate unique values such as a username, or a version mismatch.

How to fix it: Fetch the latest version, merge the changes and send the request again.

Defined in RFC 9110.

410Gone The resource was removed on purpose and will not return.

A clearer signal than 404 that the URL is permanently dead, so search engines may drop it from their index a little sooner.

Defined in RFC 9110.

411Length Required The server requires a Content-Length header.

The client sent a body without saying how long it is, and the server refuses chunked or unknown-length bodies.

Defined in RFC 9110.

412Precondition Failed A condition in the request headers, such as If-Match, was not met.

Used for optimistic concurrency: the resource changed since the client last read it, so the update is rejected to avoid overwriting someone else’s work.

Defined in RFC 9110.

413Content Too Large The request body is larger than the server allows.

Formerly named Payload Too Large or Request Entity Too Large.

Common causes: An upload above a limit such as client_max_body_size in nginx, upload_max_filesize and post_max_size in PHP, or an application limit.

How to fix it: Compress or split the upload, or raise the limit on every layer the request passes through.

Defined in RFC 9110.

414URI Too Long The URL is longer than the server will process.

Servers and proxies limit URL length, often to around 8 KB.

Common causes: Sending large data in a GET query string, or a redirect loop that keeps appending parameters.

How to fix it: Send large data in a POST body and check redirect rules for loops.

Defined in RFC 9110.

415Unsupported Media Type The server does not accept the format of the request body.

The Content-Type of the request is not one the endpoint handles.

Common causes: A missing or wrong Content-Type header, such as JSON sent without Content-Type: application/json.

How to fix it: Set the correct Content-Type and make sure the body really is in that format.

Defined in RFC 9110.

416Range Not Satisfiable The requested byte range lies outside the file.

Happens when resuming a download of a file that has since become smaller or was replaced.

Defined in RFC 9110.

417Expectation Failed The server cannot meet the requirement in the Expect header.

Usually means the server or a proxy does not support Expect: 100-continue. Removing that header fixes it.

Defined in RFC 9110.

418I’m a teapot JokeAn April Fools’ joke: the server refuses to brew coffee because it is a teapot.

Defined in a humorous 1998 RFC and reserved so it is never reused. Some sites return it playfully or to turn away unwanted bots.

Defined in RFC 2324 (April Fools’ joke).

419Page Expired UnofficialLaravel: the CSRF token is missing or has expired.

Usually appears when a form stayed open longer than the session lifetime. Reloading the page and submitting again normally works.

Non-standard, used by Laravel.

420Enhance Your Calm UnofficialRate limiting in the old Twitter API, since replaced by 429.

Non-standard. Modern APIs use 429 Too Many Requests instead.

Non-standard, used by Old Twitter API.

421Misdirected Request The request reached a server that cannot respond for this host name.

Can occur with HTTP/2 connection reuse, when a browser sends a request for one domain over a connection opened for another domain that shares a certificate.

Defined in RFC 9110.

422Unprocessable Content The request is well-formed but contains invalid data.

Popular in REST APIs for validation errors. Originally defined by WebDAV as Unprocessable Entity.

Common causes: A missing required field, an invalid email address, a value out of range or a business rule violation.

How to fix it: Read the response body, which usually lists the invalid fields, and correct them.

Defined in RFC 9110.

423Locked The resource is locked.

Another user or process holds a WebDAV lock on it.

Defined in RFC 4918 (WebDAV).

424Failed Dependency The request failed because a request it depended on failed.

Used inside WebDAV multi-step operations.

Defined in RFC 4918 (WebDAV).

425Too Early The server will not risk processing a request that might be replayed.

Relates to TLS 1.3 early data, which an attacker could replay. The client should retry after the handshake completes.

Defined in RFC 8470.

426Upgrade Required The client must switch to another protocol named in the Upgrade header.

For example a server that only accepts a newer protocol version.

Defined in RFC 9110.

428Precondition Required The server requires a conditional request.

Forces clients to send headers such as If-Match, to prevent lost updates when several clients edit the same resource.

Defined in RFC 6585.

429Too Many Requests Too many requests in a given time: you are being rate limited.

The server may include a Retry-After header saying how long to wait.

Common causes: Exceeding an API rate limit, aggressive polling or scraping, or many users sharing one IP address.

How to fix it: Honor Retry-After, add exponential backoff and caching, batch requests, or ask the provider for a higher limit.

Defined in RFC 6585.

431Request Header Fields Too Large The request headers are too large, often because of oversized cookies.

The server refuses to process headers that exceed its size limit.

Common causes: Too many or very large cookies, or long tokens in custom headers.

How to fix it: Clear the site’s cookies. On the server, store less in cookies or raise the header size limit.

Defined in RFC 6585.

440Login Time-out UnofficialIIS: the client’s session has expired and it must log in again.

Specific to Microsoft Internet Information Services and Exchange.

Non-standard, used by Microsoft IIS.

444No Response Unofficialnginx closed the connection without sending a response.

Configured with return 444; to silently drop unwanted or malicious requests. It appears in nginx logs; the client just sees a closed connection.

Non-standard, used by nginx.

449Retry With UnofficialIIS: retry the request after performing the indicated action.

Specific to Microsoft software.

Non-standard, used by Microsoft IIS.

450Blocked by Windows Parental Controls UnofficialWindows Parental Controls blocked access to this page.

Specific to Microsoft software.

Non-standard, used by Microsoft.

451Unavailable For Legal Reasons Access is blocked for legal reasons.

Used for content blocked by a court order or government demand. The number is a nod to the novel Fahrenheit 451.

Defined in RFC 7725.

494Request Header Too Large Unofficialnginx: the request headers were too large.

nginx’s own variant of 431, usually caused by large cookies.

Non-standard, used by nginx.

495SSL Certificate Error Unofficialnginx: the client certificate is invalid.

Used when a server requires TLS client certificates and the one supplied fails verification.

Non-standard, used by nginx.

496SSL Certificate Required Unofficialnginx: a client certificate is required but none was sent.

Seen on servers that use mutual TLS authentication.

Non-standard, used by nginx.

497HTTP Request Sent to HTTPS Port Unofficialnginx: plain HTTP was sent to a port that expects HTTPS.

Usually fixed by using an https:// URL or redirecting port 80 correctly.

Non-standard, used by nginx.

499Client Closed Request Unofficialnginx: the client closed the connection before the server answered.

Logged when users navigate away or a client-side timeout fires before the upstream responds. Frequent 499s can point to slow backend responses.

Non-standard, used by nginx.

5xx Server errors

500Internal Server Error A generic error: something went wrong on the server.

The server hit an unexpected condition it could not handle. The visitor cannot fix it.

Common causes: Uncaught exceptions in application code, syntax errors in configuration files such as .htaccess, failed database connections, missing environment variables or exhausted memory.

How to fix it: Check the web server and application error logs first; they almost always name the cause. If the error started after a deployment or configuration change, roll it back.

Defined in RFC 9110.

501Not Implemented The server does not support the functionality the request needs.

Typically returned for an HTTP method the server does not recognize at all.

Defined in RFC 9110.

502Bad Gateway A proxy or gateway got an invalid response from the upstream server.

The front server (nginx, a load balancer or a CDN) is working, but the application behind it is not answering properly.

Common causes: The application server (PHP-FPM, Node.js, Gunicorn and similar) crashed or is not running, the proxy points to the wrong address or port, or the upstream returned a malformed response.

How to fix it: Confirm the upstream service is running and listening where the proxy expects, then read its logs. Restarting it may help briefly, but find the crash cause.

Defined in RFC 9110.

503Service Unavailable The server is temporarily unable to handle the request.

The right status for planned maintenance, ideally with a Retry-After header.

Common causes: Maintenance mode, traffic overload, all application workers busy, or a dependency that is down.

How to fix it: Send Retry-After during maintenance, add caching or capacity for traffic spikes, and check worker and connection limits.

Defined in RFC 9110.

504Gateway Timeout A proxy did not get a response from the upstream server in time.

The upstream is reachable but too slow.

Common causes: Slow database queries, long-running requests such as reports or imports, or an upstream server that hangs.

How to fix it: Optimize slow endpoints, move long tasks to background jobs, and raise proxy timeouts (such as proxy_read_timeout in nginx) only when the work genuinely needs longer.

Defined in RFC 9110.

505HTTP Version Not Supported The server does not support the HTTP version used in the request.

Rare with modern clients, which negotiate a version the server supports.

Defined in RFC 9110.

506Variant Also Negotiates A content negotiation configuration error on the server.

The variant chosen by negotiation is itself configured to negotiate, creating a loop.

Defined in RFC 2295.

507Insufficient Storage The server cannot store what it needs to complete the request.

Usually means the disk or the user’s quota is full.

Defined in RFC 4918 (WebDAV).

508Loop Detected The server found an infinite loop while processing the request.

Used by WebDAV when following bindings leads back to where it started.

Defined in RFC 5842 (WebDAV).

509Bandwidth Limit Exceeded UnofficialThe hosting account has used up its bandwidth allowance.

Common on shared hosting. The site returns once the billing period resets or the plan is upgraded.

Non-standard, used by Apache / cPanel hosting.

510Not Extended The request needs further extensions to be fulfilled.

From an experimental HTTP extension framework that saw little use and is now classed as historic.

Defined in RFC 2774 (historic).

511Network Authentication Required You must log in to the network before going online.

Returned by captive portals on hotel, airport and café Wi-Fi to prompt you to sign in.

Defined in RFC 6585.

520Web Server Returned an Unknown Error UnofficialCloudflare: the origin returned an empty, unknown or unexpected response.

Often caused by an origin crash, oversized headers or a connection reset. Check the origin server’s logs.

Non-standard, used by Cloudflare.

521Web Server Is Down UnofficialCloudflare: the origin server refused the connection.

The origin is offline or a firewall is blocking Cloudflare’s IP ranges.

Non-standard, used by Cloudflare.

522Connection Timed Out UnofficialCloudflare: the TCP connection to the origin timed out.

The origin is overloaded, unreachable or blocking Cloudflare.

Non-standard, used by Cloudflare.

523Origin Is Unreachable UnofficialCloudflare could not reach the origin server.

Typically a DNS record pointing to the wrong address or a routing problem.

Non-standard, used by Cloudflare.

524A Timeout Occurred UnofficialCloudflare connected, but the origin did not respond in time.

The origin accepted the connection but took too long to send an HTTP response. Long tasks should run in the background.

Non-standard, used by Cloudflare.

525SSL Handshake Failed UnofficialCloudflare: the TLS handshake with the origin failed.

The origin’s TLS configuration is incompatible or missing.

Non-standard, used by Cloudflare.

526Invalid SSL Certificate UnofficialCloudflare could not validate the origin’s certificate.

Seen with strict SSL mode when the origin certificate is expired, self-signed or for the wrong host name.

Non-standard, used by Cloudflare.

How to use the HTTP Status Codes

  1. Type a code such as 502, a class such as 4xx, or a keyword such as timeout or cookies.
  2. Use the class buttons to show only informational, success, redirect, client error or server error codes.
  3. Click any code to expand its meaning. Common errors include their typical causes and how to fix them.
  4. Untick Include unofficial codes to hide server-specific codes from nginx, Cloudflare, IIS and others.

Features

  • Every standard code from RFC 9110 and related RFCs
  • Common unofficial codes from nginx, Cloudflare and IIS, clearly marked
  • Causes and fixes for the errors you meet most often
  • Instant search by number, class or keyword
  • Filter by class with one click
  • Direct links to any code, such as #code-404

The five classes of status codes

Every HTTP response starts with a three-digit status code that tells the client how the request went. The first digit defines the class, so even an unfamiliar code can be understood at a glance. The current definitions are in RFC 9110, published in 2022, with a few extra codes defined in separate RFCs and registered with IANA.

ClassMeaningWho needs to act
1xxInformational: the request is in progressNobody; handled by software
2xxSuccess: the request workedNobody
3xxRedirection: look somewhere elseThe client follows the new URL
4xxClient error: the request was wrongWhoever sent the request
5xxServer error: the server failedThe site owner or operator

Clients that meet a code they do not recognize treat it like the x00 code of its class, so an unknown 4xx is handled as 400 and an unknown 5xx as 500. That is why server-specific codes such as nginx’s 499 or Cloudflare’s 52x can exist without breaking browsers.

How status codes affect SEO

301 and 308 versus 302 and 307

Permanent redirects (301 and 308) tell search engines that the new URL replaces the old one, so the new address is indexed and ranking signals are consolidated there. Temporary redirects (302 and 307) tell them the original URL is still the one to keep. Google has said it may eventually treat a long-standing temporary redirect as permanent, but relying on that wastes time. When you move a page for good, use 301 or 308, point each old URL at its closest equivalent, and keep redirect chains to a single hop.

404 versus 410

Both remove a URL from search results over time. A 410 says the removal is deliberate and final, which can lead to slightly faster removal, while 404 leaves the door open. Neither hurts the rest of your site: missing pages are a normal part of the web. What does hurt is a soft 404, a “page not found” message served with a 200 status. Search engines may index those empty pages or flag them as errors, so make sure missing content returns a real 404 or 410.

5xx errors and crawling

When a site returns server errors or 429 responses, search engine crawlers slow down to avoid overloading it. If errors persist for days, affected URLs can be dropped from the index. For planned maintenance, return 503 Service Unavailable with a Retry-After header rather than a 200 maintenance page or a 404, which signals that the outage is temporary.

Checking the status code of a page

In any desktop browser, open the developer tools (F12), switch to the Network tab and reload: the Status column shows the code for every request, including redirects. From a terminal, curl -I https://example.com/page prints just the response headers, and adding -L follows redirects so you can see each hop in a chain.

Mistakes to avoid

  • Returning 200 for errors in an API, which forces clients to parse the body to find out something failed.
  • Using 403 when the user simply is not logged in; that is what 401 is for.
  • Redirecting every removed page to the home page, which search engines usually treat as a soft 404 anyway.
  • Hiding real server errors behind a generic 500 page without logging the cause.

Frequently asked questions

What is the difference between 401 and 403?

401 means you are not authenticated: log in or send valid credentials and try again. 403 means the server knows who you are but you do not have permission, so logging in again will not help.

Is a 301 or a 302 redirect better for SEO?

Use 301 (or 308) when a page has moved permanently, so search engines index the new URL. Use 302 (or 307) only for temporary moves where the original URL should stay indexed.

What causes a 502 Bad Gateway error?

A proxy, load balancer or CDN could not get a valid response from the application server behind it, usually because that service crashed, is not running or is misconfigured.

Do 404 errors hurt my rankings?

Not by themselves. Missing pages are normal. Fix broken internal links, redirect pages that moved, and make sure missing pages return a real 404 instead of a 200 page.

What are unofficial status codes like 499 or 522?

They are codes invented by specific servers or services, such as nginx and Cloudflare, to report situations the standards do not cover. They are marked Unofficial in this list.

More developer tools

Other free tools you might need next.

View all 24