HTTP Status Codes

Continue

The initial part of the request has been received and the client should continue sending the rest, such as the request body.

Switching Protocols

The server is switching protocols as requested by the client via the Upgrade header. Most commonly seen when opening a WebSocket connection.

The server has accepted the full request but has not yet completed it (WebDAV). Deprecated and rarely seen today.

Early Hints

Used to return preload or preconnect hints before the final response, so browsers can start fetching critical resources early.

An interim response telling the client that the server supports resumable uploads. Its Location header points to the upload resource, so an interrupted upload can be picked up again. A temporary registration from an IETF draft, not yet a final standard.

OK

The request succeeded. The meaning of success depends on the HTTP method: GET returns the resource, POST reports the result of the action.

Created

The request succeeded and a new resource was created as a result. The Location header usually points to the new resource.

Accepted

The request has been accepted for processing, but the processing has not been completed. Common for asynchronous jobs and queued processing.

Non-Authoritative Information

The request succeeded, but a transforming proxy has modified the content from the origin server’s 200 response.

No Content

The server processed the request but is not returning any content. Common for DELETE requests and save actions that need no response body.

Reset Content

Instructs the client to reset the document view that sent the request, such as clearing a submitted form.

Partial Content

The server is delivering only part of the resource due to a Range header. Used for download resumption and video streaming.

Multi-Status

Conveys information about multiple independent operations, each with its own status code (WebDAV).

Already Reported

The members of a DAV binding have already been enumerated in an earlier part of the response (WebDAV).

IM Used

The server fulfilled a GET request and the response represents the result of one or more instance manipulations, such as a delta update.

Multiple Choices

The request has more than one possible response. The client or user should choose one of them.

Moved Permanently

The URL of the requested resource has been changed permanently. Browsers cache this redirect and search engines transfer ranking signals to the new URL.

Often confused with 308 Permanent Redirect: both are permanent. After a 301 a client may change POST to GET, after a 308 the method and body stay the same.

Found

The resource is temporarily at a different URL and clients should keep using the original one. Google treats it as only a weak signal to switch to the new URL, so use 301 or 308 for permanent moves.

Often confused with 307 Temporary Redirect: both are temporary. After a 302 a client may change POST to GET, after a 307 the method and body stay the same.

See Other

The response can be found at another URL using a GET request. Often used after a POST so a page refresh does not resubmit the form.

Not Modified

The client’s cached copy is still valid and can be reused. Sent in response to conditional requests with If-None-Match or If-Modified-Since headers.

Deprecated. The requested resource must be accessed through the specified proxy. No longer used due to security concerns.

Reserved. It was defined as Switch Proxy in an early draft and is no longer used, but the number remains reserved.

Temporary Redirect

The resource is temporarily at another URL. Unlike 302, the request method and body must not change when following the redirect.

Often confused with 302 Found: both are temporary. After a 302 a client may change POST to GET, after a 307 the method and body stay the same.

Permanent Redirect

The resource has permanently moved. Like 301, but the request method and body must not change when following the redirect.

Often confused with 301 Moved Permanently: both are permanent. After a 301 a client may change POST to GET, after a 308 the method and body stay the same.

Bad Request

The server cannot process the request due to a client error. Check the request syntax, query parameters, and JSON body for mistakes.

Often confused with 422 Unprocessable Content: 400 is for a request the server cannot make sense of, such as broken JSON. 422 is for a request that parses fine but fails validation, such as a missing field. Many APIs use 400 for both.

Unauthorized

Authentication is required and has failed or has not been provided. Retry with a valid Authorization header, such as a fresh token or login.

Often confused with 403 Forbidden: 401 means valid credentials are missing, so logging in can help. 403 means the server refuses anyway, so sending the same credentials again will not.

Reserved for future use. In practice some APIs use it to signal that payment is needed or a quota has been exceeded.

Forbidden

The server understood the request but refuses to fulfill it. Sending the same credentials again will not help, and the reason may have nothing to do with credentials at all, such as a blocked IP address.

Often confused with 401 Unauthorized: 401 means valid credentials are missing, so logging in can help. 403 means the server refuses anyway, so sending the same credentials again will not.

Not Found

The server cannot find the requested resource. Check the URL for typos. APIs may also use it to hide resources from unauthorized clients.

Often confused with 410 Gone: a 404 says nothing about whether the resource will come back, a 410 says it is gone for good.

Method Not Allowed

The request method is known but not supported by this resource, such as sending POST to a GET-only endpoint. The Allow header lists supported methods.

Not Acceptable

No available representation matches the client’s Accept headers, such as requesting XML from a JSON-only API.

Proxy Authentication Required

Authentication with the proxy is required before the request can proceed. The proxy equivalent of 401.

Request Timeout

The server timed out waiting for the request. Often caused by slow networks or a client holding a connection open without sending data.

Conflict

The request conflicts with the current state of the resource. Typical for version conflicts, duplicate submissions, or concurrent edits.

Gone

The resource is gone and that is likely to be permanent, with no forwarding address. Google removes 404 and 410 pages from its index in the same way.

Often confused with 404 Not Found: a 404 says nothing about whether the resource will come back, a 410 says it is gone for good.

Length Required

The server requires a Content-Length header, which the request did not supply.

Precondition Failed

One or more conditions in the request headers, such as If-Match, evaluated to false. Used to prevent lost updates in concurrent editing.

Content Too Large

The request body is larger than the server accepts. Often an upload exceeding a size limit, such as client_max_body_size in nginx. Formerly called Payload Too Large.

URI Too Long

The URI is longer than the server can interpret, usually a query string that has grown out of control.

Unsupported Media Type

The media format of the request body is not supported by the resource. Check the Content-Type header on the request.

Range Not Satisfiable

The requested byte range cannot be fulfilled, for example a range beyond the end of the file.

Expectation Failed

The expectation given in the Expect request header cannot be met by the server.

The server refuses to brew coffee because it is, permanently, a teapot. An April Fools’ joke from 1998 that was deployed so often that the official registry now lists the number as reserved and (Unused).

Misdirected Request

The request was directed at a server that cannot produce a response, often a TLS or HTTP/2 connection reuse issue.

Unprocessable Content

The request was well-formed but contains semantic errors. Common in REST APIs when a field fails validation. Formerly called Unprocessable Entity.

Often confused with 400 Bad Request: 400 is for a request the server cannot make sense of, such as broken JSON. 422 is for a request that parses fine but fails validation, such as a missing field. Many APIs use 400 for both.

Locked

The resource being accessed is locked (WebDAV).

Failed Dependency

The request failed because a previous request it depended on also failed (WebDAV).

Too Early

The server is unwilling to risk processing a request that might be replayed, related to TLS 1.3 early data.

Upgrade Required

The client must switch to a different protocol, given in the Upgrade header, to continue.

Precondition Required

The origin server requires the request to be conditional, to prevent lost updates when multiple clients edit the same resource.

Too Many Requests

The client has sent too many requests in a given amount of time. Slow down, and if the response has a Retry-After header, wait that long before retrying.

Request Header Fields Too Large

The request headers are too large for the server to process. Oversized cookies are the most common cause.

Unavailable For Legal Reasons

The resource cannot legally be provided, often due to censorship, court order, or a takedown request. The number references Fahrenheit 451.

Internal Server Error

A generic server error when no more specific 5xx code fits. Check the server logs for the underlying exception.

Not Implemented

The server does not support the functionality needed to fulfill the request, such as an HTTP method it does not recognize at all.

Bad Gateway

The server, acting as a gateway, received an invalid response from the upstream server. Common with reverse proxies when the backend crashes.

Often confused with 504 Gateway Timeout: with a 502 the upstream server sent an invalid answer or refused the connection, with a 504 it did not answer in time.

Service Unavailable

The server is not ready to handle the request. Usually temporary: planned maintenance, an overloaded server, or a backend marked unhealthy.

Gateway Timeout

The gateway did not receive a timely response from the upstream server. Check upstream timeout settings and long-running requests.

Often confused with 502 Bad Gateway: with a 502 the upstream server sent an invalid answer or refused the connection, with a 504 it did not answer in time.

HTTP Version Not Supported

The HTTP version used in the request is not supported by the server.

Variant Also Negotiates

Transparent content negotiation resulted in a circular reference. A server configuration error.

Insufficient Storage

The server cannot store the representation needed to complete the request (WebDAV).

Loop Detected

The server detected an infinite loop while processing the request (WebDAV).

Further extensions to the request are required for the server to fulfill it. The specification was moved to Historic and the registry marks the code as obsolete.

Network Authentication Required

The client needs to authenticate to gain network access. Shown by captive portals on hotel, airport, and cafe Wi-Fi.

Page Expired

Returned by Laravel when a CSRF token is missing or expired. Refresh the page and submit the form again.

Returned by the original Twitter API when a client was rate limited. Retired in favor of the standard 429.

No Response

An nginx-specific code that closes the connection without sending any response. Used to drop malicious or unwanted requests.

Client Closed Connection

An AWS load balancer code. The client closed the connection before the load balancer’s idle timeout ran out, usually because the client’s own timeout is shorter than the time the target needs to respond.

Often confused with 499 Client Closed Request: the same event seen by different software. nginx logs 499 and an AWS load balancer records 460 when the client hangs up before the response.

Too Many Forwarded IPs

An AWS load balancer code. The X-Forwarded-For header contained more than 30 IP addresses.

Incompatible Protocol Versions

An AWS load balancer code. The protocol of the incoming request does not fit the protocol version of the target group, such as an HTTP/1.1 request sent to a gRPC or HTTP/2 target group.

Request Header Too Large

An nginx-internal code: a request header exceeded the configured buffer size. Unless an error_page rule handles it, the client receives a plain 400. A request line that is too long gets 414 instead.

SSL Certificate Error

An nginx-internal code: verifying the client’s certificate failed. It can be handled with an error_page rule, otherwise the client receives a plain 400.

SSL Certificate Required

An nginx-internal code: the client did not present the required certificate. It can be handled with an error_page rule, otherwise the client receives a plain 400.

HTTP Request Sent to HTTPS Port

An nginx-internal code: a plain HTTP request was sent to a port listening for HTTPS. Often handled with an error_page rule that redirects to HTTPS, otherwise the client receives a plain 400.

Client Closed Request

An nginx log code that is never sent to anyone: the client closed the connection before nginx could send a response. Usually an impatient client, a low proxy timeout, or users navigating away.

Often confused with 460 Client Closed Connection: the same event seen by different software. nginx logs 499 and an AWS load balancer records 460 when the client hangs up before the response.

Bandwidth Limit Exceeded

The site exceeded its hosting bandwidth quota. Common on shared cPanel and Apache hosting.

Web Server Returned an Unknown Error

A Cloudflare code: the origin returned an empty, malformed, or unexpected response. Check the origin server logs.

Web Server Is Down

A Cloudflare code: Cloudflare could not connect to the origin server. The origin is offline or blocking Cloudflare IP addresses.

Connection Timed Out

A Cloudflare code: Cloudflare timed out contacting the origin, either while opening the TCP connection or while waiting for the origin to acknowledge the request. Often firewall rules or an overloaded origin server.

Origin Is Unreachable

A Cloudflare code: Cloudflare could not route to the origin, most often a DNS or network configuration problem.

A Timeout Occurred

A Cloudflare code: the connection to the origin succeeded but no HTTP response arrived in time, or sending the request data to the origin timed out. Long-running requests are the usual cause.

SSL Handshake Failed

A Cloudflare code: the TLS handshake between Cloudflare and the origin failed. Check the origin certificate and SSL settings.

Invalid SSL Certificate

A Cloudflare code: the origin certificate was rejected, usually expired or self-signed while SSL mode is set to Full (strict).

A legacy Cloudflare code from the retired Railgun service, signaling a failed connection between Railgun components.

Origin DNS Error

A Cloudflare code shown with an accompanying 1xxx error. Most often the origin hostname could not be resolved in DNS.

Unauthorized

An AWS load balancer code. A listener rule is set to authenticate users, but the identity provider returned an error code while authenticating the user. The access logs hold the error reason code.

JWKS Request Failed

An AWS load balancer code. The load balancer did not get a successful and valid response from the JWKS endpoint it uses to verify JSON Web Tokens.