bitlvl
EN

HTTP status codes

Search by number or word. The last column is the situation that usually produces the code, which is what you need when you are staring at one in a log.

 
 
CodeNameMeaningWhen you see it
100Continue
Informational
The server has received the headers; send the body.After Expect: 100-continue, before uploading a large body.
101Switching Protocols
Informational
The server agrees to change protocol.WebSocket handshake.
102Processing
Informational
WebDAV: request accepted, still working.
103Early Hints
Informational
Preliminary headers, mainly Link: rel=preload, before the final response.CDNs and Cloudflare to start loading assets early.
200OK
Success
The request succeeded.The normal case.
201Created
Success
A new resource was created; Location header points to it.POST to a collection in a REST API.
202Accepted
Success
Accepted for processing, not finished.Async jobs and queues.
203Non-Authoritative Information
Success
Response modified by a proxy.Rare.
204No Content
Success
Success with nothing to return.DELETE, PUT, beacon endpoints, preflight responses.
205Reset Content
Success
Success; the client should reset the form.Rare.
206Partial Content
Success
Only the requested byte range is returned.Video streaming, resumable downloads (Range header).
207Multi-Status
Success
WebDAV: multiple status codes in an XML body.
226IM Used
Success
Delta encoding applied.Rare.
300Multiple Choices
Redirection
Several representations are available.Rare.
301Moved Permanently
Redirection
The resource has a new permanent URL; the browser caches the redirect. Method may change to GET.http→https, old URLs, www canonicalisation. Transfers SEO ranking.
302Found
Redirection
Temporary redirect; method may change to GET.Post-login redirects, A/B tests. Not cached by default.
303See Other
Redirection
Redirect to a different resource with GET.After a POST (post/redirect/get pattern).
304Not Modified
Redirection
The cached copy is still valid; no body.Conditional requests with If-None-Match / If-Modified-Since.
307Temporary Redirect
Redirection
Like 302 but the method and body must not change.Redirecting a POST without turning it into a GET; HSTS internal redirects in Chrome.
308Permanent Redirect
Redirection
Like 301 but the method and body must not change.Permanent redirects of API endpoints.
400Bad Request
Client error
The request is malformed; the server will not process it.Invalid JSON, bad parameters, oversized headers, invalid Host.
401Unauthorized
Client error
Authentication is required or failed. The response should say how (WWW-Authenticate).Missing or expired token. (Should have been called Unauthenticated.)
402Payment Required
Client error
Reserved; used by some APIs for quota or billing problems.Stripe, some SaaS APIs, Cloudflare for some plan limits.
403Forbidden
Client error
Authenticated (or not) but not allowed.Permission denied, WAF block, directory listing disabled, Cloudflare challenges.
404Not Found
Client error
No resource at this URL.Typos, deleted pages, wrong routes. Should return a helpful page.
405Method Not Allowed
Client error
The URL exists but not for this method; Allow header lists the valid ones.POST to a static file, GET on a webhook endpoint.
406Not Acceptable
Client error
No representation matches the Accept headers.Rare; strict content negotiation.
407Proxy Authentication Required
Client error
Authenticate with the proxy first.Corporate proxies.
408Request Timeout
Client error
The server gave up waiting for the request.Slow clients; browsers retry silently.
409Conflict
Client error
The request conflicts with the current state.Duplicate create, version mismatch, edit collisions.
410Gone
Client error
Permanently removed, and the server knows it.Tells search engines to drop the URL faster than 404.
411Length Required
Client error
Content-Length header missing.Some servers for chunked uploads.
412Precondition Failed
Client error
An If-* condition failed.Optimistic concurrency with ETags (If-Match).
413Content Too Large
Client error
Body exceeds the limit.nginx client_max_body_size, upload limits.
414URI Too Long
Client error
The URL exceeds the limit (typically 8 KB).Huge GET query strings; use POST.
415Unsupported Media Type
Client error
The Content-Type is not supported.Sending form data where JSON is expected.
416Range Not Satisfiable
Client error
The Range header is outside the file.Broken resumable downloads.
417Expectation Failed
Client error
The Expect header cannot be met.Old proxies with Expect: 100-continue.
418I'm a teapot
Client error
April Fools RFC 2324.Easter eggs; some sites use it to reject bots.
421Misdirected Request
Client error
Sent to a server that cannot produce a response for this host.HTTP/2 connection reuse across hostnames with the wrong certificate.
422Unprocessable Content
Client error
Syntactically valid but semantically wrong.Validation errors in REST APIs (Rails, Laravel, GitHub).
423Locked
Client error
WebDAV: resource is locked.
424Failed Dependency
Client error
WebDAV: a previous request failed.
425Too Early
Client error
The server will not process a request that might be replayed (TLS 1.3 0-RTT).
426Upgrade Required
Client error
Switch to a different protocol.Forcing TLS or HTTP/2.
428Precondition Required
Client error
The request must be conditional.APIs enforcing If-Match to prevent lost updates.
429Too Many Requests
Client error
Rate limit hit; Retry-After says when to try again.API throttling, login brute-force protection, Cloudflare rate limiting.
431Request Header Fields Too Large
Client error
Headers exceed the limit.Huge cookies.
451Unavailable For Legal Reasons
Client error
Blocked by a legal demand.Geo-blocking for GDPR, court orders.
500Internal Server Error
Server error
The server hit an unexpected error.Uncaught exceptions, misconfiguration. Check the server logs, not the browser.
501Not Implemented
Server error
The server does not support the method.Rare; PATCH on old servers.
502Bad Gateway
Server error
A proxy got an invalid response from the upstream.App server crashed or not listening; nginx/HAProxy/Cloudflare in front of a dead backend.
503Service Unavailable
Server error
Temporarily unable to handle the request.Maintenance, overload, all backends down. Send Retry-After.
504Gateway Timeout
Server error
The upstream did not answer in time.Slow backend behind a proxy (proxy_read_timeout, Cloudflare’s 100 s limit).
505HTTP Version Not Supported
Server error
The HTTP version is not supported.Rare.
507Insufficient Storage
Server error
WebDAV: out of space.
508Loop Detected
Server error
WebDAV: infinite loop.
510Not Extended
Server error
Further extensions required.Rare.
511Network Authentication Required
Server error
Log in to the network first.Captive portals in hotels and airports.
520Cloudflare: Unknown Error
Cloudflare
The origin returned something Cloudflare could not interpret (empty reply, invalid headers, > 16 KB headers).Origin resets the connection or sends garbage.
521Cloudflare: Web Server Is Down
Cloudflare
Cloudflare could not connect to the origin on the port.Origin firewall blocking Cloudflare IPs, web server stopped.
522Cloudflare: Connection Timed Out
Cloudflare
TCP handshake with the origin timed out.Origin overloaded or unreachable, wrong DNS IP.
523Cloudflare: Origin Is Unreachable
Cloudflare
No route to the origin.Wrong IP in DNS, origin network down.
524Cloudflare: A Timeout Occurred
Cloudflare
TCP connected but the origin did not send a response within 100 seconds.Slow scripts, long reports, big uploads; move the work async.
525Cloudflare: SSL Handshake Failed
Cloudflare
TLS handshake with the origin failed.Full (strict) mode without a valid origin certificate, cipher mismatch.
526Cloudflare: Invalid SSL Certificate
Cloudflare
Origin certificate not trusted (Full strict).Self-signed origin cert; use a Cloudflare Origin Certificate.
530Cloudflare: Origin DNS Error / 1xxx
Cloudflare
Returned with a 1xxx error code in the body.Tunnel down, DNS error, bans.

The five classes

1xx informational, rarely seen outside protocol upgrades. 2xx success. 3xx redirection: the client must look elsewhere. 4xx the client did something wrong (or is not allowed). 5xx the server failed. A browser or client that meets an unknown code treats it as the x00 of its class, so new codes degrade gracefully.

Pairs people mix up

  • 301 vs 302 vs 307/308: 301 and 308 are permanent (cached, and search engines move the ranking); 302 and 307 are temporary. The 7/8 variants forbid changing the method, so a POST stays a POST; 301/302 let the browser turn it into a GET. Use 308 for permanent API moves, 301 for web pages, 303 after a form POST.
  • 401 vs 403: 401 means “who are you?” (missing or bad credentials; retry with auth). 403 means “I know who you are and the answer is no.” Returning 404 instead of 403 is legitimate when you do not want to reveal that the resource exists.
  • 502 vs 503 vs 504: all come from a proxy in front of your app. 502: the backend answered with garbage or closed the connection (crashed, wrong port). 503: nothing available (maintenance, all backends down, overloaded). 504: the backend took too long. Cloudflare's 52x codes refine these further.
  • 400 vs 422: 400 for a request the server cannot parse at all; 422 for one it parsed but rejects on validation. Many APIs use 400 for both.

Cloudflare 52x

Cloudflare adds its own codes for problems between its edge and your origin. 521 means it could not open a TCP connection (firewall, server down), 522 the connection timed out (wrong IP, overloaded), 524 the connection worked but the origin did not answer within 100 seconds, 525/526 TLS problems with the origin certificate (switch to Full strict with an Origin Certificate, or to Flexible). They always point at your server or the path to it, never at the visitor.

Questions

What is the difference between 404 and 410?

404 says nothing is here now; 410 says it was here and was removed on purpose. Search engines drop a 410 URL faster. Use 410 for deleted content you will not restore.

Should an API return 200 with an error in the body?

No. Clients, proxies, caches and monitoring all key on the status code. Use 4xx for client mistakes and 5xx for server failures, with details in the body (RFC 9457 problem+json is the standard shape).

Why do I get 502 from nginx?

nginx could not get a valid response from the upstream: the app is not running, listens on a different port or socket, crashed mid-request, or sent headers nginx rejected. Check the app’s logs and nginx’s error log, not the browser.

What does 429 mean and what should I do?

Too many requests: you hit a rate limit. Wait for the time in the Retry-After header, then retry with backoff. For APIs, spread calls out or request a higher quota.

Related tools

Port number referenceWhat listens on which port: well-known and commonly seen TCP/UDP ports, searchableUser-agent parserBrowser, engine, OS, device and bot detection for any User-Agent stringURL encode / decodePercent-encoding for components, whole URLs and form data, plus a query-string parserDNS record explainerPaste dig output or zone lines: every record decoded, SPF, DKIM and DMARC checked