HTTP Status Codes: Every Code Explained, With Common Fixes

An HTTP status code is the three-digit number at the start of a server's response that says how the request went: 200 worked, 404 was not found, 500 the server broke. This is the full list, from 100 to 530. Search by number, by name or by what you are seeing, and every code says what it means, when you run into it and how to fix it.

Search status codes

82 status codes, from 100 to 530. Everything runs in your browser and nothing is uploaded.

1xx informational

The request was received and the server is carrying on. Interim signals, rarely seen.

100 Continue

Official

What it means: The server has received the request headers and the client should go ahead and send the body.
When you see it: A client sent Expect: 100-continue before a large upload, to check the server will accept it first. Most tools handle it for you and you rarely see it.
What to do: Nothing to fix. If an upload stalls waiting for it, turn off the Expect header in the client, or check that the server and any proxy in front of it support it.

Defined in RFC 9110, section 15.2.1

101 Switching Protocols

Official

What it means: The server agrees to switch to the protocol the client asked for in its Upgrade header.
When you see it: Opening a WebSocket connection, or upgrading a connection from HTTP/1.1 to another protocol.
What to do: Nothing to fix. If a WebSocket fails to open, check that the proxy or load balancer passes the Upgrade and Connection headers through.

Defined in RFC 9110, section 15.2.2

102 Processing

Official

What it means: The server has accepted a long-running WebDAV request and is still working on it, so the client should keep waiting.
When you see it: A WebDAV server doing slow work such as copying a large folder. RFC 4918 dropped it, so almost nothing sends it now.
What to do: Nothing to do but wait. If you are writing a server, send the final response when the work finishes and skip 102.

Defined in RFC 2518, now historic

103 Early Hints

Official

What it means: The server sends the headers it already knows, usually Link headers, before the real response is ready, so the browser can start loading stylesheets and scripts early.
When you see it: A CDN or web server that supports preloading while it builds the page. The browser uses it and you never see it on screen.
What to do: Nothing to fix. Send it from your server or CDN to speed up page loads, and follow it with the final response.

Defined in RFC 8297

2xx success

The request was received, understood and accepted.

200 OK

Official

What it means: The request worked and the response carries the result.
When you see it: Almost every normal page load, GET request and successful API call.
What to do: Nothing to fix. If the body is not what you expected, the request reached the right place but asked for the wrong thing: check the URL, query string and headers.

Defined in RFC 9110, section 15.3.1

201 Created

Official

What it means: The request worked and created a new resource. The Location header should give its address.
When you see it: A POST or PUT that adds a record, such as signing up a user or creating an order through an API.
What to do: Nothing to fix. When you build an API, return 201 with a Location header for the new resource rather than a plain 200.

Defined in RFC 9110, section 15.3.2

202 Accepted

Official

What it means: The server took the request and will deal with it later. It has not finished, and the response does not say whether it will succeed.
When you see it: Queued or asynchronous work: sending a batch email, starting a video render or kicking off a report.
What to do: Nothing to fix. Poll the status address the server gives you, or wait for a webhook, to learn the outcome.

Defined in RFC 9110, section 15.3.3

203 Non-Authoritative Information

Official

What it means: The request worked, but a proxy changed the response, so it may differ from what the origin server sent.
When you see it: A transforming proxy sitting between you and the server. It is rare in practice.
What to do: Nothing to fix. If you need the origin's exact response, request it directly or check the proxy's settings.

Defined in RFC 9110, section 15.3.4

204 No Content

Official

What it means: The request worked and there is nothing to send back. The response has no body.
When you see it: A DELETE that succeeded, a PUT or PATCH that saved, or an autosave call that only needs to say it is done.
What to do: Nothing to fix. Do not parse the body: calling response.json() on a 204 throws, so check the status first.

Defined in RFC 9110, section 15.3.5

205 Reset Content

Official

What it means: The request worked, and the client should clear the form or view it was sent from.
When you see it: A form submission where the server wants the form emptied for the next entry. Browsers barely support it.
What to do: Nothing to fix. Clear the form yourself in code, since not every client does it for you.

Defined in RFC 9110, section 15.3.6

206 Partial Content

Official

What it means: The server is sending only the part of the resource the client asked for with a Range header.
When you see it: Streaming video or audio, resuming a download, or a PDF viewer loading page by page.
What to do: Nothing to fix. If a download restarts from the beginning, the server may not support ranges, so check that it sends Accept-Ranges: bytes.

Defined in RFC 9110, section 15.3.7

207 Multi-Status

Official

What it means: A WebDAV response that holds several results, one for each resource the request touched, in an XML body.
When you see it: A WebDAV request that acts on many files at once, such as PROPFIND on a folder.
What to do: Read the body: each part has its own status, and some may have failed even though the overall response is 207.

Defined in RFC 4918

208 Already Reported

Official

What it means: Inside a WebDAV 207 response, this resource was already listed earlier in the same response, so it is not repeated.
When you see it: A WebDAV request over bindings, where one resource is reachable at several paths.
What to do: Nothing to fix. Match it with the earlier entry for the same resource.

Defined in RFC 5842

226 IM Used

Official

What it means: The server has applied one or more instance manipulations, such as a delta encoding, to produce this response.
When you see it: A client that asked for a delta against a cached copy with A-IM. Almost nothing uses it.
What to do: Nothing to fix. A client that did not send A-IM should never receive it.

Defined in RFC 3229

3xx redirection

The client has to do something more, usually follow a redirect, to finish the request.

300 Multiple Choices

Official

What it means: The resource has more than one representation, and the client has to pick one.
When you see it: A server offering the same document in several formats or languages without choosing for you. Rare.
What to do: Pick a link from the body or send a more specific Accept header. If you run the server, redirect to a default instead.

Defined in RFC 9110, section 15.4.1

301 Moved Permanently

Official

What it means: The resource has a new permanent address in the Location header. Browsers and search engines should use it from now on.
When you see it: A page was renamed or moved, a site switched from http to https, or www was added or removed from the domain.
What to do: Update your links to the new address. A redirect loop means two rules point at each other: check the redirect rules and any http to https and www settings. Browsers cache a 301 hard, so test in a private window.

Defined in RFC 9110, section 15.4.2

302 Found

Official

What it means: The resource is at a different address for now. Keep using the original address next time.
When you see it: A login redirect, a language redirect, or any temporary move. Browsers often change a POST into a GET when they follow it.
What to do: Nothing to fix if the redirect is intended. Use 307 to keep the request method, or 301 if the move is permanent. A loop usually comes from a missing cookie or a rule that always redirects.

Defined in RFC 9110, section 15.4.3

303 See Other

Official

What it means: The response to your request is at another address, and you should fetch it with a GET.
When you see it: The redirect after a form POST, so that refreshing the result page does not submit the form again.
What to do: Nothing to fix. Follow the Location header with a GET. When you build a form handler, redirect with 303 after a successful POST.

Defined in RFC 9110, section 15.4.4

304 Not Modified

Official

What it means: The copy the client already has is still current, so the server sends no body.
When you see it: A browser or CDN revalidating a cached file with If-None-Match or If-Modified-Since.
What to do: Nothing to fix. It saves bandwidth. If you see stale content, clear the cache or change the file's ETag or URL.

Defined in RFC 9110, section 15.4.5

305 Use Proxy

Official

What it means: The resource must be reached through the proxy named in the Location header. It is deprecated and clients ignore it.
When you see it: Practically never, because it was a security risk and was dropped.
What to do: Nothing to fix. Configure the proxy on the client instead.

Defined in RFC 9110, section 15.4.6

306 (Unused)

Unused

What it means: A code that once meant Switch Proxy. It is reserved so nobody reuses it, and it means nothing now.
When you see it: Never. A server that sends it is broken.
What to do: Nothing to fix on your side. If a server returns it, report it to whoever runs the server.

Defined in RFC 9110, section 15.4.7

307 Temporary Redirect

Official

What it means: The resource is at another address for now, and the client must repeat the same request there with the same method and body.
When you see it: A temporary move that has to keep a POST a POST, and the redirect a browser sends when an HSTS rule upgrades http to https.
What to do: Nothing to fix if it is intended. Use 302 or 303 if the method is allowed to change, or 308 if the move is permanent.

Defined in RFC 9110, section 15.4.8

308 Permanent Redirect

Official

What it means: The resource has a new permanent address, and the client must repeat the same request there with the same method and body.
When you see it: A permanent move of an API endpoint that takes POST requests, where a 301 might turn them into GETs.
What to do: Update your links to the new address. Use 301 instead when it is a normal page and the method does not matter.

Defined in RFC 9110, section 15.4.9

4xx client error

The request is wrong or not allowed. The fix is usually on the client's side.

400 Bad Request

Official

What it means: The server cannot understand the request because it is malformed, so it will not process it.
When you see it: Invalid JSON in the body, a missing required field, a bad query string, a mangled cookie or a header that is too large.
Common fix: Check the request against the API's documentation: valid JSON, correct Content-Type, required fields present, URL characters encoded. In a browser, clearing the site's cookies often fixes it.

Defined in RFC 9110, section 15.5.1

401 Unauthorized

Official

What it means: The request has no valid credentials. Despite the name it means unauthenticated: the server does not know who you are.
When you see it: A missing, expired or wrong API key, token or password, or a request that left out the Authorization header.
Common fix: Send valid credentials, or log in again if the token expired. The response's WWW-Authenticate header says which scheme the server wants. If you are signed in and still blocked, you probably need 403 instead.

Defined in RFC 9110, section 15.5.2

402 Payment Required

Official

What it means: Reserved for payment systems. HTTP never defined how it works, so each service decides.
When you see it: Some APIs and platforms send it when a plan, quota or card is unpaid or exhausted.
Common fix: Check the service's billing page or its API documentation for what its 402 means. For your own API, a 403 or 429 is usually clearer.

Defined in RFC 9110, section 15.5.3

403 Forbidden

Official

What it means: The server knows who you are and refuses to let you do this. Logging in again will not help.
When you see it: A signed-in user without the right role, a blocked IP address, a file or folder without read permission, or a firewall rule.
Common fix: Ask for access, or use an account that has it. On a server, check file permissions, directory listing settings, firewall and CORS or WAF rules. Some sites return 404 here to hide that the page exists.

Defined in RFC 9110, section 15.5.4

404 Not Found

Official

What it means: The server cannot find anything at this address. It does not say whether the page is gone for good or was never there.
When you see it: A mistyped or old URL, a deleted page, a broken link, or a route the app does not define.
Common fix: Check the URL for typos and the path's case. On a server, check the route exists and the file is deployed. For a page that is gone for good, use 410, and for one that moved, a 301 redirect.

Defined in RFC 9110, section 15.5.5

405 Method Not Allowed

Official

What it means: The address exists, but not for this HTTP method. The Allow header lists the methods it does accept.
When you see it: Sending a POST to an endpoint that only takes GET, or a DELETE to one that does not allow it.
Common fix: Use a method from the Allow header. On a server, add a handler for that method. A form that posts to a static file or a path a redirect turned into a GET is a common cause.

Defined in RFC 9110, section 15.5.6

406 Not Acceptable

Official

What it means: The server cannot produce a response in any of the formats the client's Accept headers allow.
When you see it: Asking for a content type, language or encoding the server does not have, such as Accept: application/xml from a JSON-only API.
Common fix: Relax or correct the Accept headers, or ask for a format the server supports. Some web firewalls also return 406 for a request they dislike.

Defined in RFC 9110, section 15.5.7

407 Proxy Authentication Required

Official

What it means: Like 401, but the credentials are needed by a proxy between you and the server.
When you see it: A corporate or school proxy that wants a login before it forwards requests.
Common fix: Send credentials in a Proxy-Authorization header, or put the proxy's username and password in the client's proxy settings.

Defined in RFC 9110, section 15.5.8

408 Request Timeout

Official

What it means: The server waited for the request to arrive and gave up. The client was too slow sending it.
When you see it: A very slow connection, a client that opened a connection and then stalled, or a large upload that took too long.
Common fix: Retry the request. On the server side, raise the request or idle timeout in the web server, proxy or load balancer if legitimate clients are being cut off.

Defined in RFC 9110, section 15.5.9

409 Conflict

Official

What it means: The request clashes with the current state of the resource, so the server cannot apply it.
When you see it: Creating something that already exists, such as a duplicate username, or saving an edit based on an out-of-date version.
Common fix: Fetch the current state, resolve the difference and send the request again. When you build an API, put what conflicted in the response body.

Defined in RFC 9110, section 15.5.10

410 Gone

Official

What it means: The resource used to be here and has been removed on purpose, with no new address.
When you see it: A deleted page or a retired API version that the owner wants clients and search engines to forget.
Common fix: Remove or update your links. When you run the server, use 410 instead of 404 for content that is permanently gone, so search engines drop it sooner.

Defined in RFC 9110, section 15.5.11

411 Length Required

Official

What it means: The server insists on a Content-Length header and the request did not have one.
When you see it: A POST or PUT sent without a length, such as a streamed body to a server that cannot accept chunked encoding.
Common fix: Send a Content-Length header with the body's size in bytes. Most HTTP clients add it for you if you pass the body as a string or file.

Defined in RFC 9110, section 15.5.12

412 Precondition Failed

Official

What it means: A condition in the request headers, such as If-Match, was not true on the server, so it did not act.
When you see it: Updating a resource with an If-Match ETag that has gone stale, because someone else changed it first.
Common fix: Fetch the resource again to get its current ETag, redo your change on top of it and resend. It is how APIs avoid lost updates.

Defined in RFC 9110, section 15.5.13

413 Content Too Large

Official

What it means: The request body is bigger than the server is willing to handle. Older documents call it Payload Too Large or Request Entity Too Large.
When you see it: Uploading a file or posting a body over the server's limit. nginx's default is 1 MB.
Common fix: Send less data, or raise the limit on the server: client_max_body_size in nginx, LimitRequestBody in Apache, or the body size setting in your framework or CDN.

Defined in RFC 9110, section 15.5.14

414 URI Too Long

Official

What it means: The address in the request is longer than the server will accept.
When you see it: A query string stuffed with data, or a redirect loop that keeps appending to the URL.
Common fix: Send the data in a POST body instead of the URL. If the URL grows on each request, look for a redirect loop. Servers can raise the limit, but shorter is safer.

Defined in RFC 9110, section 15.5.15

415 Unsupported Media Type

Official

What it means: The server does not accept the format of the request body.
When you see it: Posting JSON without a Content-Type: application/json header, or sending a file type the endpoint does not take.
Common fix: Set Content-Type to a type the endpoint accepts and make sure the body really is in that format.

Defined in RFC 9110, section 15.5.16

416 Range Not Satisfiable

Official

What it means: The client asked for a byte range that is outside the resource, for example past the end of the file.
When you see it: Resuming a download of a file that has since shrunk or been replaced, or a bad Range header.
Common fix: Restart the download from the beginning, or ask for a range inside the file. The Content-Range header in the response gives the real size.

Defined in RFC 9110, section 15.5.17

417 Expectation Failed

Official

What it means: The server cannot meet the requirement in the request's Expect header.
When you see it: A client sending Expect: 100-continue to a server or proxy that does not support it.
Common fix: Remove the Expect header from the request. In curl, add -H 'Expect:' to turn it off.

Defined in RFC 9110, section 15.5.18

418 I'm a teapot

Unofficial: RFC 2324 joke

What it means: A joke from the Hyper Text Coffee Pot Control Protocol: a teapot refuses to brew coffee. The IANA registry lists 418 as (Unused) so that nobody gives it a real meaning.
When you see it: An Easter egg that sites and frameworks add on purpose, or a server using it as a polite no for requests it never wants, such as scrapers.
Common fix: Nothing to fix, it is on purpose. Do not use it for real errors, since clients do not know what it means.

Defined in RFC 2324 and RFC 7168

419 Page Expired

Unofficial: Laravel

What it means: The page's CSRF token is missing or has expired, so the framework refuses to process the form.
When you see it: Submitting a Laravel form after leaving the page open too long, or after the session or cookies were cleared.
Common fix: Reload the page and submit again. As the developer, include the @csrf token in the form and check the session lifetime and cookie settings.

421 Misdirected Request

Official

What it means: The request was sent to a server that cannot answer for that host name.
When you see it: HTTP/2 connection reuse, where a browser sends a request for one site down a connection opened for another, for example with a wildcard certificate.
Common fix: Browsers retry on a new connection by themselves. A server or proxy should send it only when it is not configured for the host. Check the SNI and virtual host settings.

Defined in RFC 9110, section 15.5.20

422 Unprocessable Content

Official

What it means: The request is well formed and the type is right, but the server cannot act on it because of what it says. Older documents call it Unprocessable Entity.
When you see it: Validation errors in an API: an email that is not an email, a date in the past, a missing required value in otherwise valid JSON.
Common fix: Read the response body, which normally lists the fields that failed, correct the data and send it again.

Defined in RFC 9110, section 15.5.21

423 Locked

Official

What it means: A WebDAV code: the resource is locked and the request cannot change it.
When you see it: Editing a file in a WebDAV share, such as SharePoint, while another user or process holds a lock on it.
Common fix: Wait for the lock to be released, ask the person who holds it, or supply the right lock token.

Defined in RFC 4918

424 Failed Dependency

Official

What it means: A WebDAV code: the request failed because an earlier request it depended on failed.
When you see it: Inside a 207 Multi-Status response, on the parts that were skipped after another part failed.
Common fix: Fix the request that failed first, then repeat the whole operation.

Defined in RFC 4918

425 Too Early

Official

What it means: The server will not risk processing a request that might be replayed, which can happen with TLS 1.3 early data.
When you see it: A request sent in TLS 1.3 early data (0-RTT) to a server that does not allow replay of that kind of request.
Common fix: Send the request again after the handshake completes, which clients normally do for you.

Defined in RFC 8470

426 Upgrade Required

Official

What it means: The server will not handle the request over this protocol and wants the client to upgrade, for example to TLS or a newer HTTP version.
When you see it: Calling an API that now requires HTTPS, or a server that wants an Upgrade to a specific protocol.
Common fix: Use the protocol named in the response's Upgrade header, usually by switching http:// to https://.

Defined in RFC 9110, section 15.5.22

428 Precondition Required

Official

What it means: The server requires the request to be conditional, usually with If-Match, to prevent two clients overwriting each other's changes.
When you see it: Updating a resource without sending the If-Match header the API insists on.
Common fix: Fetch the resource, then send your update with If-Match set to its ETag.

Defined in RFC 6585

429 Too Many Requests

Official

What it means: The client has sent too many requests in a given time, so the server is rate limiting it.
When you see it: Calling an API faster than its limit, hammering a login form, or a crawler that is too eager.
Common fix: Slow down and retry after the delay in the Retry-After header. Add backoff with jitter to retries, cache responses, batch calls, or ask for a higher limit.

Defined in RFC 6585

431 Request Header Fields Too Large

Official

What it means: The headers, taken together or one on its own, are bigger than the server will accept.
When you see it: Cookies that have grown too large, which is the usual cause, or a very long Authorization token or Referer.
Common fix: Clear the site's cookies. On a server, remove cookies you no longer need, or raise the header size limit, for example large_client_header_buffers in nginx.

Defined in RFC 6585

440 Login Time-out

Unofficial: Microsoft IIS

What it means: The client's session has expired and it must log in again.
When you see it: An IIS-hosted application whose login session timed out.
Common fix: Log in again. An administrator can lengthen the session timeout.

444 No Response

Unofficial: nginx

What it means: nginx closed the connection without sending any response, on purpose. It shows up in nginx's logs, not in a browser.
When you see it: A server rule that drops requests it does not want, such as scanners or unknown hosts.
Common fix: Nothing to fix if you wrote the rule. Clients see a dropped connection and no status at all.

451 Unavailable For Legal Reasons

Official

What it means: The server cannot show this because of a legal demand, such as a court order, a takedown or a regional law. The number is a nod to the novel Fahrenheit 451.
When you see it: Content blocked in your country, removed after a copyright or privacy request, or a site that turns away visitors from regions whose law it cannot meet.
Common fix: Nothing you can fix in the request. The response may say who ordered the block and where to read more.

Defined in RFC 7725

460 Client Closed Connection

Unofficial: AWS Elastic Load Balancer

What it means: The client closed the connection to the load balancer before the idle timeout passed and before the target replied.
When you see it: A slow target, or a client with a short timeout that gave up and hung up.
Common fix: Make the target respond faster, or raise the client's timeout. Check the load balancer's idle timeout is longer than your slowest requests.

463 Too Many X-Forwarded-For Addresses

Unofficial: AWS Elastic Load Balancer

What it means: The load balancer received an X-Forwarded-For header with more than 30 IP addresses and refused it.
When you see it: A request that passed through a long chain of proxies, or one with a forged X-Forwarded-For header.
Common fix: Reduce the number of proxies in front of the load balancer, or strip or reject the header at the edge.

494 Request Header Too Large

Unofficial: nginx

What it means: nginx rejected the request because a header, or the request line, was too large. It is reported to the client as a 400.
When you see it: Huge cookies or a very long URL, which is the same problem as a 431.
Common fix: Clear the site's cookies or shorten the URL. On the server, raise large_client_header_buffers.

495 SSL Certificate Error

Unofficial: nginx

What it means: nginx rejected the client's certificate during a TLS client-certificate check because it was invalid. It is reported to the client as a 400.
When you see it: Mutual TLS, where the server demands a client certificate and the one sent failed.
Common fix: Send a certificate signed by an authority the server trusts, and check it has not expired.

496 SSL Certificate Required

Unofficial: nginx

What it means: nginx required a client certificate and the client did not send one. It is reported to the client as a 400.
When you see it: Mutual TLS, where the server demands a client certificate and the client sent none.
Common fix: Configure the client to present a certificate, for example with curl --cert and --key.

497 HTTP Request Sent to HTTPS Port

Unofficial: nginx

What it means: A plain http request arrived on a port that expects https. nginx reports it as a 400.
When you see it: Visiting http://example.com:443, or a client with the wrong scheme for the port.
Common fix: Use https:// for that port, or fix the URL's scheme or port. On the server, add a redirect from the http port to https.

499 Client Closed Request

Unofficial: nginx

What it means: The client closed the connection before nginx had finished its response. It appears in nginx logs and the client never sees it.
When you see it: A user left the page, a client gave up waiting, or a load balancer timed out first. Lots of 499s point at slow responses.
Common fix: Nothing to send back. Speed up the slow endpoint, or lengthen the client's timeout. A 499 spike usually means requests are too slow, not that anything is broken.

5xx server error

The request looked fine but the server failed to handle it. The fix is on the server's side.

500 Internal Server Error

Official

What it means: The server hit an unexpected problem and could not complete the request. It is a catch-all for a bug on the server's side.
When you see it: An unhandled exception in the application, a bad configuration, a failed database call or a broken deploy.
Common fix: As a visitor, wait and retry, since you cannot fix it. As the owner, read the server error log for the stack trace, then check the last deploy, config and database connection.

Defined in RFC 9110, section 15.6.1

501 Not Implemented

Official

What it means: The server does not support what the request needs, most often the HTTP method.
When you see it: An unusual method such as PATCH or a WebDAV verb sent to a server that never learned it.
Common fix: Use a method the server supports. If you run the server, add handling for the method, or return 405 instead when the method is known but not allowed for that address.

Defined in RFC 9110, section 15.6.2

502 Bad Gateway

Official

What it means: A server acting as a gateway or proxy got an invalid response from the server behind it.
When you see it: The app behind nginx, a load balancer or a CDN crashed, is still starting up, or is returning garbage.
Common fix: Retry in a minute. As the owner, check that the upstream app is running and listening on the right port, read both the proxy and the app logs, and check for a crash or a bad deploy.

Defined in RFC 9110, section 15.6.3

503 Service Unavailable

Official

What it means: The server cannot handle the request right now, usually because it is overloaded or down for maintenance. The problem should be temporary.
When you see it: A traffic spike, a deploy in progress, maintenance mode, or an autoscaler that has not caught up. A Retry-After header may say when to return.
Common fix: Retry after a short wait, or the time in Retry-After. As the owner, add capacity, check the app's health and send 503 with Retry-After for planned maintenance so search engines do not drop the page.

Defined in RFC 9110, section 15.6.4

504 Gateway Timeout

Official

What it means: A gateway or proxy did not get an answer from the server behind it in time.
When you see it: A slow database query, a hung upstream service, or a request that takes longer than the proxy's timeout.
Common fix: Retry, or make the request lighter. As the owner, find the slow step, move long work to a background job, or raise the proxy timeout, for example proxy_read_timeout in nginx.

Defined in RFC 9110, section 15.6.5

505 HTTP Version Not Supported

Official

What it means: The server does not support the HTTP version used in the request.
When you see it: A very old or very new client talking to a server that only speaks some HTTP versions.
Common fix: Use a supported version, for example HTTP/1.1. Check the server's protocol settings.

Defined in RFC 9110, section 15.6.6

506 Variant Also Negotiates

Official

What it means: A server configuration error: transparent content negotiation is set up so that the chosen variant is itself negotiating, which makes a circular reference.
When you see it: A misconfigured server doing content negotiation. Very rare.
Common fix: Fix the server configuration so the negotiation points at a real resource. Visitors cannot fix it.

Defined in RFC 2295

507 Insufficient Storage

Official

What it means: A WebDAV code: the server has run out of the space it needs to store what the request wants to create.
When you see it: Uploading to a WebDAV share, or a server whose disk or quota is full.
Common fix: Free up space or raise the quota on the server. Check the disk and any storage limits.

Defined in RFC 4918

508 Loop Detected

Official

What it means: A WebDAV code: the server stopped because it found an infinite loop while handling the request.
When you see it: A WebDAV request over bindings that point back at themselves.
Common fix: Fix the circular references in the collection, then repeat the request.

Defined in RFC 5842

509 Bandwidth Limit Exceeded

Unofficial: Apache and cPanel hosting

What it means: The site has used up the bandwidth its hosting plan allows.
When you see it: Shared hosting after a traffic spike, or a plan limit reached partway through the month.
Common fix: Wait for the limit to reset, upgrade the plan, or cut the traffic, for example by compressing images and caching with a CDN.

510 Not Extended

Official

What it means: The server needs a further extension of the request to carry it out. It comes from an experimental extension framework that never caught on.
When you see it: Practically never.
Common fix: Nothing to fix on your side. If you see it, the server needs an extension declaration the client does not know about.

Defined in RFC 2774, now historic

511 Network Authentication Required

Official

What it means: You have to log in to the network before you can reach the internet.
When you see it: A captive portal, the sign-in page of a hotel, airport, cafe or school Wi-Fi, that intercepts your request.
Common fix: Open a page in the browser and complete the Wi-Fi sign-in. Then repeat the request.

Defined in RFC 6585

520 Web Server Returned an Unknown Error

Unofficial: Cloudflare

What it means: Cloudflare got an empty, oversized or otherwise unexpected response from the origin server and cannot tell what went wrong.
When you see it: An origin that crashed, closed the connection, or sent headers that were too large or malformed.
Common fix: Check the origin server's error log, and look at its response headers and cookies for something very large or invalid. Test it by requesting the origin directly.

521 Web Server Is Down

Unofficial: Cloudflare

What it means: Cloudflare could not connect to the origin server because it refused the connection.
When you see it: The origin is offline, or its firewall blocks Cloudflare's IP addresses.
Common fix: Make sure the origin is running and listening, and allow Cloudflare's IP ranges through its firewall.

522 Connection Timed Out

Unofficial: Cloudflare

What it means: Cloudflare connected to the internet side of the origin but the origin did not complete the connection in time.
When you see it: An overloaded or unreachable origin, or a firewall dropping Cloudflare's packets.
Common fix: Check the origin's load and network, and allow Cloudflare's IP ranges. Confirm the DNS record points to the right IP address.

523 Origin Is Unreachable

Unofficial: Cloudflare

What it means: Cloudflare cannot find a route to the origin server.
When you see it: A wrong IP address in DNS, or a routing problem between Cloudflare and the host.
Common fix: Check the DNS record points to the origin's correct public IP address, and ask the hosting provider about routing.

524 A Timeout Occurred

Unofficial: Cloudflare

What it means: Cloudflare connected to the origin, but the origin did not send a response within about 100 seconds.
When you see it: A long-running request: a big report, an import or a slow query.
Common fix: Move the long task to a background job and return quickly, or speed the request up. Raising the timeout needs an Enterprise plan.

525 SSL Handshake Failed

Unofficial: Cloudflare

What it means: Cloudflare could not complete the TLS handshake with the origin server.
When you see it: The origin has no HTTPS on port 443, or supports no cipher or TLS version Cloudflare will use.
Common fix: Enable HTTPS on the origin with a valid certificate, or set Cloudflare's SSL/TLS mode to match what the origin supports.

526 Invalid SSL Certificate

Unofficial: Cloudflare

What it means: Cloudflare could not validate the TLS certificate on the origin server, and the SSL mode is set to check it.
When you see it: An expired, self-signed or wrong-host certificate on the origin while Cloudflare's SSL mode is Full (strict).
Common fix: Install a valid certificate on the origin, such as a Cloudflare Origin CA certificate, or loosen the SSL mode if that is acceptable.

530 Origin DNS Error

Unofficial: Cloudflare

What it means: Cloudflare could not resolve the origin's host name. It comes with a 1xxx error code on the page that says why.
When you see it: A DNS record that is missing or points to a name that does not resolve.
Common fix: Read the 1xxx error code shown with it. Check the DNS records for the domain and the origin's host name.

Type a number such as 404, the start of one such as 40, a class such as 5xx, or a name such as gateway or rate limit. The chips narrow the list to one class, or to the unofficial codes. Each code has its own link: tap Link on a card to copy it, so you can send someone straight to #429.

The five classes

The first digit of a status code tells you who has to act.

Class	Meaning	Who usually fixes it
1xx	Informational: the request was received and the server is carrying on	Nobody. You rarely see these
2xx	Success: the request was understood and accepted	Nothing to fix
3xx	Redirection: the client has to go somewhere else to finish	The client follows the `Location` header
4xx	Client error: the request is wrong or not allowed	The caller: fix the request, the login or the URL
5xx	Server error: the request looked fine and the server failed	The owner of the server

A good rule when something breaks: a 4xx means look at what you sent, and a 5xx means look at the server's logs.

Codes that get mixed up

401 and 403. 401 is "I do not know who you are" and 403 is "I know who you are, and no". Logging in fixes a 401. A 403 needs different permissions.
404 and 410. Both mean the page is not there. 410 says it was removed on purpose and will not return, which tells search engines to drop it sooner.
400 and 422. 400 means the request could not be read, such as broken JSON. 422 means it was read and the values are not acceptable, such as an invalid email.
301 and 308, 302 and 307. The permanent and temporary pairs differ in method handling: 301 and 302 may turn a POST into a GET, 307 and 308 may not.
500, 502, 503 and 504. 500 is the app failing. The other three come from a proxy or load balancer: 502 for a bad reply from the app, 503 for a service that is overloaded or down for maintenance, and 504 for no reply in time.
429 and 503. 429 says you in particular are sending too many requests. 503 says nobody can be served right now. Both can carry a Retry-After header.

What to do with a 4xx or 5xx

Read the body. APIs usually explain a 400, 409 or 422 in the response body, with the field that failed.
Check the URL, method and headers. Most 404, 405, 406 and 415 responses come from a wrong path, the wrong method or a missing Content-Type or Accept header.
Check your credentials. A 401 means a missing or expired token. A 403 means the account lacks permission.
Retry the temporary ones. 408, 429, 502, 503 and 504 often clear on their own. Wait, and use exponential backoff with a bit of jitter rather than hammering the server. Respect Retry-After.
For a 5xx you run, go to the logs. The reverse proxy's log and the app's log together show whether the app crashed, timed out or never started.

Unofficial codes

The IANA registry is the official list, and anyone can still invent a number. Servers, proxies, CDNs and frameworks have done so for years, and a few of those numbers turn up in logs and error pages often enough to be worth knowing:

nginx logs 499 when the client hangs up first, and uses 444 to close a connection without answering.
Cloudflare uses 520 to 526 for the different ways it can fail to reach your origin server: unknown error, server down, timeout, unreachable, slow response, bad TLS handshake and invalid certificate.
Laravel returns 419 when a form's CSRF token has expired.
418 is the I'm a teapot joke. The registry lists it as Unused.

These carry an Unofficial badge with the product that uses them. Do not rely on an unofficial code in your own API, because a client has no way to know what it means. Use an official one, and put the detail in the body.

Common gotchas

The name is not always the meaning. 401 is called Unauthorized and means unauthenticated. 403 is the real "not authorised".
Some names changed. RFC 9110 renamed 413 from Payload Too Large to Content Too Large, and 422 from Unprocessable Entity to Unprocessable Content. This page uses the current names and searches the old ones too.
A 200 can still be an error. Some APIs return 200 with an error in the body. Do not rely on the status alone for those, and do not build APIs that way.
Browsers cache a 301 hard. If you fixed a redirect and the browser still follows the old one, test in a private window or clear the cache.
Some sites hide a 403 as a 404. To avoid confirming that a private page exists, a server may return 404 to people who may not see it.
HTTP/2 and HTTP/3 have no reason phrases. The text next to the number, like "Not Found", is only a label. The number is what counts.

The JavaScript cheat sheet for fetch and checking response.ok and response.status, and the Python cheat sheet for working with HTTP in code.
JSON Formatter to read the JSON error body an API sends back with a 4xx or 5xx.
Base64 Encoder and Decoder to look inside the token behind a 401, since a JWT is Base64 text.
Unix Timestamp Converter for the exp of an expired token, or a Retry-After date.
Regex Tester to pick status codes out of an access log, for example \s5\d\d\s.

Common questions

What are HTTP status codes?

An HTTP status code is the three-digit number a server puts at the start of every response to say how the request went. The first digit gives the class: 1xx is informational, 2xx is success, 3xx is a redirect, 4xx means the request was wrong and 5xx means the server failed. The codes are defined in RFC 9110 and listed in the IANA HTTP Status Code Registry.

What does HTTP 404 mean?

404 Not Found means the server could not find anything at that address. The page may have been moved or deleted, the link may have a typo, or the app has no route for it. The server does not say whether it is gone for good. A page that has been removed on purpose should return 410 Gone, and one that has moved should redirect with a 301.

What is an HTTP 500 error and how do I fix it?

500 Internal Server Error means the server hit a problem it did not expect and could not finish the request. As a visitor you cannot fix it, so wait and try again. If you run the site, the cause is in the server's error log: an unhandled exception, a bad configuration, a failed database connection or a broken deploy. Read the log first, then check what changed last.

What is the difference between 401 and 403?

401 Unauthorized means the server does not know who you are: you sent no credentials, or the ones you sent are missing, expired or wrong. Logging in fixes it. 403 Forbidden means the server knows who you are and still says no, so logging in again will not help. You need a different account or permission.

What is the difference between 301, 302, 307 and 308?

301 and 308 are permanent moves, and 302 and 307 are temporary ones. The difference inside each pair is the method. 301 and 302 let a client turn a POST into a GET when it follows the redirect, which browsers usually do. 307 and 308 require the same method and body to be repeated. Use 301 for a page that has moved for good, and 308 or 307 for an API that takes POST requests.

What is the difference between 502, 503 and 504?

All three come from a server acting as a gateway or proxy. 502 Bad Gateway means the server behind it sent an invalid response, often because the app crashed or is still starting. 503 Service Unavailable means the service cannot take requests right now, because of overload or maintenance. 504 Gateway Timeout means the server behind it did not answer in time, often because of a slow query.

Is HTTP 418 I'm a teapot a real status code?

Sort of. It comes from RFC 2324, an April Fools joke from 1998 about a protocol for controlling coffee pots, and it is not part of HTTP. The IANA registry lists 418 as Unused, so that no one gives it a real meaning. Some servers and frameworks still return it as an Easter egg, and some use it to turn away unwanted requests.

What does 499 mean?

499 Client Closed Request is not an official code. nginx records it in its logs when the client hung up before nginx finished responding. The client never sees it. A lot of 499s usually mean responses are too slow, so people give up or a load balancer in front times out first.

Which status codes are official?

The official codes are the ones in the IANA HTTP Status Code Registry, about 60 with a meaning, most of them defined in RFC 9110. Others are used by one product only: 499 and 444 by nginx, 520 to 526 by Cloudflare, 419 by Laravel. Each code on this page is marked Official or Unofficial, with the product that uses it.

Is anything I type here sent to a server?

No. The whole list is built into the page and search runs in your browser. The site records which filter you picked, how long your search was and roughly how many codes it found, so we know what to improve. What you type in the search box is never part of that.

1xx informational

2xx success

3xx redirection

4xx client error

5xx server error

The five classes

Codes that get mixed up

What to do with a 4xx or 5xx

Unofficial codes

Common gotchas

Related

Common questions

More Web and API tools

Unix Timestamp Converter: Epoch Time to Date and Back

Regex Tester: Test JavaScript Regular Expressions Online

cURL Converter: Convert cURL to Python, JavaScript, Go and PHP

Want this explained by a cat?