Search every HTTP status code and find out what it means, why it happens, and how to fix it, from 100 Continue to 599.
The request was received and processing continues.
The server received the request headers and the client should send the body.
Sent in reply to a request with Expect: 100-continue, so a client can check that a large upload will be accepted before sending it.
OfficialRFC 9110, Section 15.2.1
The server agrees to switch protocols as requested in the Upgrade header.
Most often seen when a connection is upgraded to WebSocket.
OfficialRFC 9110, Section 15.2.2
The server accepted the request but has not finished processing it.
Prevented client timeouts on long WebDAV operations. Removed from later WebDAV specifications.
OfficialDeprecatedRFC 2518 (WebDAV)
Lets the browser start preloading resources (Link headers) while the server prepares the final response.
Used by CDNs and servers to speed up page loads with preload and preconnect hints.
OfficialRFC 8297
The request was received, understood, and accepted.
The request succeeded.
The meaning depends on the method: GET returns the resource, POST returns the result of the action.
OfficialRFC 9110, Section 15.3.1
The request succeeded and a new resource was created.
Typical reply to POST in REST APIs. The Location header should point to the new resource.
OfficialRFC 9110, Section 15.3.2
The request was accepted for processing, but processing has not finished.
Used for asynchronous jobs and queues. Return a way to check the status, such as a job URL.
OfficialRFC 9110, Section 15.3.3
The response was modified by a transforming proxy.
OfficialRFC 9110, Section 15.3.4
The request succeeded and there is no body to return.
Common for DELETE, PUT, and CORS preflight responses. Calling response.json() on it fails because the body is empty.
OfficialRFC 9110, Section 15.3.5
The request succeeded; the client should reset the document view, e.g. clear a form.
OfficialRFC 9110, Section 15.3.6
The server is returning only the byte range requested with the Range header.
Used for resumable downloads and video streaming.
OfficialRFC 9110, Section 15.3.7
The body contains separate status codes for multiple resources.
OfficialRFC 4918 (WebDAV)
Members of a WebDAV binding were already listed earlier in the response.
OfficialRFC 5842 (WebDAV)
The response is the result of instance manipulations (delta encoding) applied to the resource.
OfficialRFC 3229
The client must take further action, usually follow another URL.
The resource has several representations and the client should choose one.
OfficialRFC 9110, Section 15.4.1
The resource has a new permanent URL, given in the Location header.
Search engines transfer ranking to the new URL. Browsers cache it aggressively and may change POST to GET; use 308 to keep the method.
OfficialRFC 9110, Section 15.4.2
The resource is temporarily at another URL, given in the Location header.
Browsers usually change POST to GET when following it. Use 307 to keep the method, or 303 for redirect-after-POST.
OfficialRFC 9110, Section 15.4.3
The client should fetch the result from another URL with GET.
The standard Post/Redirect/Get pattern after a form submission.
OfficialRFC 9110, Section 15.4.4
The cached copy is still valid, so no body is sent.
Reply to a conditional request with If-None-Match (ETag) or If-Modified-Since.
OfficialRFC 9110, Section 15.4.5
The resource must be accessed through a proxy. Deprecated for security reasons and ignored by browsers.
OfficialDeprecatedRFC 9110, Section 15.4.6
Reserved. Was "Switch Proxy" in an early draft and is no longer used.
OfficialDeprecatedRFC 9110, Section 15.4.7
The resource is temporarily at another URL; repeat the request with the same method and body.
Also used internally by browsers for HSTS upgrades from http:// to https://.
OfficialRFC 9110, Section 15.4.8
The resource has a new permanent URL; repeat the request with the same method and body.
Like 301, but POST stays POST.
OfficialRFC 9110, Section 15.4.9
The request is wrong or cannot be fulfilled as sent.
The server cannot process the request because it is malformed.
Typical causes: invalid JSON, missing required fields, wrong parameter types, or a bad Content-Type. Check the response body for the exact validation error.
OfficialRFC 9110, Section 15.5.1
Authentication is required or the credentials are invalid.
Really means "unauthenticated". Check that the Authorization header is sent and the token has not expired. The response should include a WWW-Authenticate header.
OfficialRFC 9110, Section 15.5.2
Reserved for future use; some APIs use it when a payment or quota is required.
OfficialRFC 9110, Section 15.5.3
The server understood the request but refuses to authorize it.
The user is known but lacks permission. Logging in again does not help. Also returned by WAFs and for blocked IPs or directory listing.
OfficialRFC 9110, Section 15.5.4
The server cannot find the requested resource.
Check the URL, path parameters, and trailing slashes. Also used instead of 403 to hide that a resource exists.
OfficialRFC 9110, Section 15.5.5
The HTTP method is not supported for this resource.
For example POST to a read-only endpoint. The Allow header lists the supported methods.
OfficialRFC 9110, Section 15.5.6
The server cannot produce a response matching the Accept headers.
OfficialRFC 9110, Section 15.5.7
The client must authenticate with the proxy first (Proxy-Authorization header).
OfficialRFC 9110, Section 15.5.8
The server timed out waiting for the client to finish sending the request.
OfficialRFC 9110, Section 15.5.9
The request conflicts with the current state of the resource.
Typical for duplicate records (unique constraints), edit conflicts, and version mismatches.
OfficialRFC 9110, Section 15.5.10
The resource was permanently removed and will not come back.
Search engines drop 410 URLs faster than 404 URLs.
OfficialRFC 9110, Section 15.5.11
The server requires a Content-Length header.
OfficialRFC 9110, Section 15.5.12
A condition in the request headers (If-Match, If-Unmodified-Since) is false.
Used for optimistic concurrency: someone else changed the resource first.
OfficialRFC 9110, Section 15.5.13
The request body is larger than the server allows. Formerly "Payload Too Large".
Raise the limit, e.g. client_max_body_size in nginx, or upload in chunks.
OfficialRFC 9110, Section 15.5.14
The URL is longer than the server will process.
Usually too much data in the query string; send it in a POST body instead.
OfficialRFC 9110, Section 15.5.15
The server does not support the body's format.
Most often a missing or wrong Content-Type, e.g. sending JSON without Content-Type: application/json.
OfficialRFC 9110, Section 15.5.16
The requested byte range is outside the resource's size.
OfficialRFC 9110, Section 15.5.17
The server cannot meet the Expect request header.
OfficialRFC 9110, Section 15.5.18
The server refuses to brew coffee because it is, permanently, a teapot.
An April Fools' joke from the Hyper Text Coffee Pot Control Protocol (1998). The code is reserved so it is never reused, and some sites return it to bots or for requests they will not handle.
OfficialRFC 2324 / RFC 9110, Section 15.5.19
The CSRF token is missing or expired.
Reload the form page to get a fresh token, or include the X-CSRF-TOKEN header in AJAX requests.
UnofficialLaravel
The client is being rate limited. Replaced by 429.
UnofficialTwitter API v1 (legacy)
The request reached a server that cannot respond for this host.
Seen with HTTP/2 connection reuse across hosts that share a certificate.
OfficialRFC 9110, Section 15.5.20
The body is well-formed but contains invalid data. Formerly "Unprocessable Entity".
Common for validation errors in Rails, Laravel, and FastAPI.
OfficialRFC 9110, Section 15.5.21
The resource is locked.
OfficialRFC 4918 (WebDAV)
The request failed because a request it depended on failed.
OfficialRFC 4918 (WebDAV)
The server will not process a request that might be replayed (TLS early data).
OfficialRFC 8470
The client must switch to another protocol, given in the Upgrade header.
OfficialRFC 9110, Section 15.5.22
The server requires a conditional request (e.g. If-Match) to prevent lost updates.
OfficialRFC 6585
The client sent too many requests in a given time (rate limiting).
Wait for the time in the Retry-After header and retry with exponential backoff.
OfficialRFC 6585
The headers are too large, often because of oversized cookies.
Clearing cookies for the site usually fixes it in the browser.
OfficialRFC 6585
The session expired and the client must log in again.
UnofficialMicrosoft IIS
nginx closed the connection without sending a response.
Used in nginx configs to drop malicious or unwanted requests. Never actually reaches the client.
Unofficialnginx
Access is denied for legal reasons, such as censorship or a court order.
A reference to the novel Fahrenheit 451.
OfficialRFC 7725
nginx-internal code for headers that are too large; the client sees 400.
Unofficialnginx
The client certificate is invalid.
Unofficialnginx
A client certificate is required but was not provided.
Unofficialnginx
A plain HTTP request was sent to a port that expects HTTPS.
Unofficialnginx
The client closed the connection before the server responded.
Seen in nginx logs when users navigate away or a client timeout is shorter than the server's processing time.
Unofficialnginx
The server failed to fulfill a valid request.
The server hit an unexpected condition.
A generic error, usually an unhandled exception. Check the server logs; the client cannot fix it.
OfficialRFC 9110, Section 15.6.1
The server does not support the functionality needed, such as an unknown method.
OfficialRFC 9110, Section 15.6.2
A gateway or proxy got an invalid response from the upstream server.
Typical with nginx or a load balancer when the app crashed, is not listening on the expected port, or closed the connection.
OfficialRFC 9110, Section 15.6.3
The server is temporarily unable to handle requests (overload or maintenance).
Should include Retry-After. Use 503 rather than 200 for maintenance pages so search engines do not index them.
OfficialRFC 9110, Section 15.6.4
A gateway or proxy did not get a response from the upstream server in time.
The app is too slow or hung. Raise proxy timeouts or move slow work to a background job.
OfficialRFC 9110, Section 15.6.5
The server does not support the HTTP version of the request.
OfficialRFC 9110, Section 15.6.6
Server misconfiguration in transparent content negotiation.
OfficialRFC 2295
The server cannot store the data needed to complete the request.
OfficialRFC 4918 (WebDAV)
The server found an infinite loop while processing the request.
OfficialRFC 5842 (WebDAV)
The hosting account exceeded its bandwidth quota.
UnofficialApache / cPanel
Further extensions to the request are required. Obsoleted.
OfficialDeprecatedRFC 2774
The client must authenticate to gain network access, e.g. a hotel or airport Wi-Fi captive portal.
OfficialRFC 6585
The origin server returned an empty, unknown, or unexpected response.
UnofficialCloudflare
The origin server refused the connection from Cloudflare.
The web server is stopped or a firewall blocks Cloudflare's IP ranges.
UnofficialCloudflare
Cloudflare could not complete a TCP connection to the origin server.
UnofficialCloudflare
Cloudflare cannot reach the origin, often because of DNS or routing problems.
UnofficialCloudflare
The origin accepted the connection but did not respond within 100 seconds.
UnofficialCloudflare
The TLS handshake between Cloudflare and the origin failed.
UnofficialCloudflare
Cloudflare could not validate the origin's SSL certificate (Full (strict) mode).
UnofficialCloudflare
Returned with a Cloudflare 1xxx error, such as an origin DNS failure.
UnofficialCloudflare
A proxy timed out reading from the network.
UnofficialSome proxies
A proxy timed out connecting to the upstream server.
UnofficialSome proxies
Every HTTP response starts with a three-digit status code that tells the client how the request went. The first digit sets the class: 1xx informational, 2xx success, 3xx redirection, 4xx client errors, and 5xx server errors. Clients that do not know a code treat it like the x00 code of its class, so an unknown 4xx is handled like 400.
All status codes registered with IANA, with the RFC that defines them, plus deprecated codes marked as such.
Codes you meet in practice but not in the RFCs: nginx 444 and 499, Cloudflare 520 to 526, Laravel 419, and more.
Common codes explain when they appear and what to check, from missing Content-Type headers (415) to app crashes behind a proxy (502).
Search by number, class (4xx), or keyword such as timeout, redirect, or cache. Each code has a shareable link, e.g. #404.
401 Unauthorized means the request is not authenticated: credentials are missing, wrong, or expired, and logging in may help. 403 Forbidden means the server knows who you are, but you do not have permission, so logging in again does not help.
301 and 308 are permanent redirects; 302 and 307 are temporary. 307 and 308 require the client to repeat the same method and body, while with 301 and 302 browsers usually switch POST to GET. Use 301 or 308 for SEO when a page has moved for good.
It started as an April Fools' joke in RFC 2324 (1998), the Hyper Text Coffee Pot Control Protocol. It is not meant for real use, but RFC 9110 reserves 418 so it is never assigned to anything else, and many frameworks still support it.
A proxy or load balancer, such as nginx or Cloudflare, could not get a valid response from the application behind it. Usually the app crashed, is not running, listens on a different port, or closed the connection. Check the app's logs and the proxy's upstream settings.
Use 400 Bad Request for malformed requests (such as invalid JSON) and 422 Unprocessable Content when the request is well-formed but the data is invalid. Return details about each invalid field in the body.
499 Client Closed Request is an nginx-only code logged when the client disconnected before the server answered, for example when a user closed the page or a client timeout was shorter than the server's response time.
Percent-encode or decode URLs and query values, and unwrap double-encoded strings from logs in one click.
Break a URL into protocol, host, port, path, and fragment, and edit its query parameters as a key-value table.
Identify the browser, operating system, device type, and bots from any User-Agent string, one or thousands at once.
Convert cURL commands, including Copy as cURL from DevTools, into JavaScript fetch() or axios code.
