HTTP status codes: searchable reference
Every standard HTTP status code plus the common non-standard ones from nginx, Cloudflare and Laravel, each with what it means and what usually causes it. Type a code or a word to filter.
🔒 Runs entirely in your browser. Nothing you paste is uploaded or sent to a server.
| Code | Name and meaning | Common cause / what to check |
|---|---|---|
| 100 | Continue The server got the request headers and the client may send the body. | Client sent Expect: 100-continue before a large upload (curl does this for bodies over 1 KB). |
| 101 | Switching Protocols The server is switching to the protocol the client asked for in Upgrade. | Normal for WebSocket handshakes; if a WebSocket fails, check that your proxy forwards the Upgrade and Connection headers. |
| 102 | Processing WebDAV: the request is accepted but still being processed. | Long WebDAV operations; rarely seen today. |
| 103 | Early Hints Preliminary headers (usually Link: preload) sent before the final response. | CDN or server sending preload hints; harmless. |
| 200 | OK The request succeeded. | Normal success. If an API returns 200 with an error message in the body, the API is just designed that way. |
| 201 | Created The request succeeded and a new resource was created. | Successful POST/PUT; the Location header usually points to the new resource. |
| 202 | Accepted The request was accepted for processing, but processing is not finished. | Asynchronous jobs and queues; poll the status URL the API gives you. |
| 203 | Non-Authoritative Information The response was modified by a transforming proxy. | A proxy changed the original 200 response. |
| 204 | No Content Success, with no response body. | Normal for DELETE or PUT. Calling response.json() on it throws "Unexpected end of JSON input". |
| 205 | Reset Content Success; the client should reset the form or view. | Rare. |
| 206 | Partial Content Only the byte range asked for in a Range header is returned. | Resumable downloads and video streaming. |
| 207 | Multi-Status WebDAV: several status codes for several resources in an XML body. | WebDAV clients (Nextcloud, SharePoint). |
| 208 | Already Reported WebDAV: members already listed earlier in the same response. | Rare. |
| 226 | IM Used The response is the result of instance manipulations (delta encoding). | Rare. |
| 300 | Multiple Choices There are several representations to choose from. | Rare in practice. |
| 301 | Moved Permanently The resource has a new permanent URL (in Location). Browsers and search engines remember it. | HTTP→HTTPS or old→new URL redirects. Redirect loops between 301s cause ERR_TOO_MANY_REDIRECTS. Fix guide → |
| 302 | Found Temporary redirect to the URL in Location. | Login redirects; a POST may be changed to GET (use 307 to keep the method). Fix guide → |
| 303 | See Other Go GET the resource at the Location URL. | Post/Redirect/Get pattern after submitting a form. |
| 304 | Not Modified The cached copy is still valid; no body is sent. | Conditional request with If-None-Match / If-Modified-Since. Normal; not an error. |
| 305 | Use Proxy Deprecated: access the resource through a proxy. | Obsolete; ignored by browsers. |
| 307 | Temporary Redirect Temporary redirect that keeps the original method and body. | HSTS internal redirects in Chrome show as 307. |
| 308 | Permanent Redirect Permanent redirect that keeps the original method and body. | Like 301 but safe for POST. Next.js and many hosts use it for trailing-slash redirects. |
| 400 | Bad Request The server cannot process the request because it is malformed. | Invalid JSON body, wrong Content-Type, a header or cookie that is too large, missing required fields. |
| 401 | Unauthorized Authentication is required or the credentials are invalid. | Missing or expired token, wrong API key, Authorization header not sent (often lost on redirects). |
| 402 | Payment Required Reserved; used by some APIs for billing problems. | Quota exhausted or unpaid plan on SaaS APIs. |
| 403 | Forbidden The server understood the request but refuses it. Logging in again will not help. | File permissions, missing index file with autoindex off, IP/WAF block, wrong IAM permissions, CSRF failure. Fix guide → |
| 404 | Not Found No resource at this URL. | Typo in the path, missing trailing slash, wrong base path, SPA route without a fallback to index.html. |
| 405 | Method Not Allowed The URL exists but does not accept this HTTP method. | POST to a static file, or a route defined only for GET. The Allow header lists valid methods. |
| 406 | Not Acceptable No representation matches the Accept headers. | Strict Accept header; send Accept: application/json or */*. |
| 407 | Proxy Authentication Required You must authenticate with the proxy first. | Corporate proxy; set credentials in HTTPS_PROXY or the proxy settings. |
| 408 | Request Timeout The server timed out waiting for the client to send the request. | Slow or idle client connection; keep-alive connections closed by the server. |
| 409 | Conflict The request conflicts with the current state of the resource. | Duplicate resource, version/ETag mismatch, concurrent edits, Kubernetes "the object has been modified". |
| 410 | Gone The resource was removed permanently and will not come back. | Deleted content; search engines drop 410 URLs faster than 404. |
| 411 | Length Required The server requires a Content-Length header. | Chunked upload to a server that does not support it. |
| 412 | Precondition Failed A condition in If-Match / If-Unmodified-Since was not met. | Optimistic locking: someone else changed the resource first. |
| 413 | Content Too Large The request body is larger than the server allows (formerly "Payload Too Large"). | nginx client_max_body_size (default 1 MB), upload limits in PHP, Express body-parser or the load balancer. Fix guide → |
| 414 | URI Too Long The URL is longer than the server will accept. | Huge query strings; send the data in a POST body instead. |
| 415 | Unsupported Media Type The server does not accept the body's Content-Type. | Sending JSON without Content-Type: application/json, or form data to a JSON-only API. |
| 416 | Range Not Satisfiable The requested byte range is outside the file. | Resuming a download of a file that changed or is smaller. |
| 417 | Expectation Failed The server cannot meet the Expect header. | Server rejects Expect: 100-continue; send the request without it (curl -H 'Expect:'). |
| 418 | I'm a teapot April Fools' joke from RFC 2324; the server refuses to brew coffee. | Easter eggs, or used by some services to reject bots. |
| 419 | Page Expired Laravel Laravel: the CSRF token is missing or expired. | Form submitted after the session expired, or the @csrf token is missing. |
| 421 | Misdirected Request The request went to a server that cannot answer for this host. | HTTP/2 connection reuse across hosts with different certificates. |
| 422 | Unprocessable Content The body is well-formed but has semantic errors (validation failed). | Validation errors in Rails, Laravel, FastAPI (check the response body for field errors). |
| 423 | Locked WebDAV: the resource is locked. | A file opened by another WebDAV client. |
| 424 | Failed Dependency WebDAV: the request failed because a previous one failed. | Rare. |
| 425 | Too Early The server will not process a request that might be replayed (TLS early data). | TLS 1.3 0-RTT requests. |
| 426 | Upgrade Required The client must switch to another protocol (given in Upgrade). | Server requires TLS or a newer HTTP version. |
| 428 | Precondition Required The server requires a conditional request (If-Match). | APIs that enforce optimistic locking. |
| 429 | Too Many Requests Rate limit exceeded. | Too many requests per time window; respect the Retry-After header and add backoff. |
| 431 | Request Header Fields Too Large The headers are too big. | Too many or too large cookies (often on localhost shared by many apps); clear cookies for the site. |
| 440 | Login Time-out Microsoft IIS IIS: the session expired. | Re-login required. |
| 444 | No Response nginx nginx closed the connection without sending a response. | An nginx rule with return 444 (used to drop bad bots or unknown hosts). |
| 451 | Unavailable For Legal Reasons The resource is blocked for legal reasons. | Government censorship, court orders, or geo-blocking (GDPR). |
| 494 | Request Header Too Large nginx nginx: the request headers are too large. | Large cookies; raise large_client_header_buffers. |
| 495 | SSL Certificate Error nginx nginx: the client certificate is invalid. | Mutual TLS with an invalid client certificate. |
| 496 | SSL Certificate Required nginx nginx: a client certificate is required but was not sent. | Mutual TLS: the client did not present a certificate. |
| 497 | HTTP Request Sent to HTTPS Port nginx nginx: plain HTTP was sent to an HTTPS port. | Using http:// on port 443 or a TLS port; use https://. |
| 499 | Client Closed Request nginx nginx: the client closed the connection before the server answered. | The user, browser or an upstream load balancer gave up waiting (timeouts); look for slow backends. Fix guide → |
| 500 | Internal Server Error Generic server-side failure. | An unhandled exception in the application; the real error is in the application log, not the browser. |
| 501 | Not Implemented The server does not support the functionality (usually the method). | Unknown HTTP method, or an endpoint stub. |
| 502 | Bad Gateway A proxy or gateway got an invalid response (or no response) from the upstream server. | The app behind nginx/a load balancer is down, crashed, listening on another port or socket, or closed the connection. Fix guide → |
| 503 | Service Unavailable The server is temporarily unable to handle the request. | Overload, maintenance mode, no healthy backends, Kubernetes service with no ready pods. |
| 504 | Gateway Timeout A proxy or gateway did not get a response from the upstream server in time. | Slow queries or requests exceeding proxy_read_timeout (nginx default 60 s) or the load balancer idle timeout. Fix guide → |
| 505 | HTTP Version Not Supported The server does not support the HTTP version used. | Very old or misconfigured servers. |
| 506 | Variant Also Negotiates Content negotiation configuration error on the server. | Rare. |
| 507 | Insufficient Storage WebDAV: the server cannot store the representation. | Disk or quota full on the server. |
| 508 | Loop Detected WebDAV: infinite loop while processing. | Rare; some hosts use it for resource limits. |
| 510 | Not Extended Further extensions are required (obsolete). | Rare. |
| 511 | Network Authentication Required You must log in to the network first. | Captive portal on hotel, airport or café Wi-Fi. |
| 520 | Web Server Returned an Unknown Error Cloudflare Cloudflare: the origin returned an empty, unknown or unexpected response. | Origin crashed, reset the connection or sent headers larger than Cloudflare allows. |
| 521 | Web Server Is Down Cloudflare Cloudflare: the origin refused the connection. | Web server not running, or a firewall blocks Cloudflare IPs. Fix guide → |
| 522 | Connection Timed Out Cloudflare Cloudflare: the TCP connection to the origin timed out. | Origin overloaded, wrong DNS IP, or firewall dropping Cloudflare traffic. |
| 523 | Origin Is Unreachable Cloudflare Cloudflare: cannot reach the origin. | Wrong DNS record or routing problem to the origin. |
| 524 | A Timeout Occurred Cloudflare Cloudflare: connected to the origin, but it did not respond within 100 seconds. | Long-running requests; move them to background jobs or raise the timeout (Enterprise). Fix guide → |
| 525 | SSL Handshake Failed Cloudflare Cloudflare: the TLS handshake with the origin failed. | Origin has no valid TLS setup on 443 while SSL mode is Full / Full (strict). Fix guide → |
| 526 | Invalid SSL Certificate Cloudflare Cloudflare: the origin certificate is invalid (Full strict mode). | Expired, self-signed or wrong-host certificate on the origin. Fix guide → |
| 530 | Origin DNS Error Cloudflare Cloudflare: usually shown together with a 1xxx error such as 1016. | DNS record for the origin does not resolve. |
The five classes
| Class | Meaning | Whose problem? |
|---|---|---|
| 1xx | Informational, request continues | nobody |
| 2xx | Success | nobody |
| 3xx | Redirect: look at the Location header |
usually configuration |
| 4xx | The request was wrong: URL, auth, body, size, rate | the client (or how the client is configured) |
| 5xx | The server or something behind it failed | the server or proxy |
502 vs 503 vs 504
These three come from a proxy or load balancer (nginx, Apache, AWS ALB, Cloudflare) in front of your application, not from the application itself:
- 502 Bad Gateway: the proxy reached the backend but got garbage or a dropped connection, or could not connect at all. The app crashed, is not listening, or listens on a different port/socket. See fixing 502 Bad Gateway.
- 503 Service Unavailable: no healthy backend is available (all down, overloaded, maintenance mode, Kubernetes pods not ready).
- 504 Gateway Timeout: the backend accepted the connection but did not answer in time. See fixing 504 Gateway Timeout.
Check the proxy's error log first (/var/log/nginx/error.log): it says exactly which upstream failed and why.
401 vs 403
401 Unauthorized really means unauthenticated: no credentials, or bad ones. Logging in or sending a valid token fixes it. 403 Forbidden means the server knows who you are (or does not care) and still refuses: file permissions, IP rules, a WAF, missing directory index. See nginx 403 Forbidden.
Checking a status code
curl -sS -o /dev/null -w '%{http_code}\n' https://example.com/ # just the code
curl -sSI https://example.com/ # headers only
curl -sSIL https://example.com/ # follow redirects
In the browser, open DevTools → Network and look at the Status column. Codes in the 52x range and 499 are not in the HTTP standard; they are generated by Cloudflare and nginx and are marked as non-standard in the table above.
Last updated 2026-11-05.