HTTP Status Codes
Every Code, Explained

The server received the request headers and the client should send the body.

Common causes: A client sent Expect: 100-continue before uploading a large body.

What to check: Nothing to fix - the client continues. If uploads stall, check that proxies pass Expect: 100-continue.

HTTP/1.1 100 Continue

Defined in RFC 9110

The server is switching to the protocol the client asked for in its Upgrade header.

Common causes: A WebSocket handshake or an HTTP/1.1 to h2c upgrade.

What to check: If WebSockets fail, make sure every proxy forwards the Upgrade and Connection headers.

HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade

Defined in RFC 9110

WebDAV interim response: the request is still being processed, so the client should not time out.

Common causes: Long-running WebDAV operations such as a large COPY or MOVE.

What to check: Deprecated and rarely sent. Prefer 202 Accepted with a status URL for long jobs.

HTTP/1.1 102 Processing

Defined in RFC 2518

An interim response with Link headers so the browser can preload assets while the server builds the page.

Common causes: CDNs and servers sending preload or preconnect hints ahead of the final response.

What to check: Only Link headers matter here. Confirm the final response repeats the same hints.

HTTP/1.1 103 Early Hints
Link: </css/site.css>; rel=preload; as=style

Defined in RFC 8297

The request succeeded and the response carries the result.

Common causes: A normal successful GET, or a POST that returns a result.

What to check: If a page returns 200 but shows an error, you have a soft 404 - return a real 4xx status instead.

HTTP/1.1 200 OK
Content-Type: application/json

Defined in RFC 9110

The request created a new resource.

Common causes: A POST or PUT that created a record.

What to check: Send a Location header pointing at the new resource so clients can fetch it.

HTTP/1.1 201 Created
Location: /api/orders/1042
Content-Type: application/json

Defined in RFC 9110

The request was accepted for processing, but the work has not finished.

Common causes: Queued jobs: video encoding, report generation, bulk imports.

What to check: Return a status URL (often in Location) the client can poll for the result.

HTTP/1.1 202 Accepted
Location: /api/jobs/77/status
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

Success, but a transforming proxy modified the response from the origin.

Common causes: A proxy that rewrote or filtered the content.

What to check: Rarely seen. If unexpected, look for a proxy or security product altering responses.

HTTP/1.1 203 Non-Authoritative Information
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

The request succeeded and there is intentionally no body.

Common causes: A successful DELETE, a PUT with nothing to return, or a beacon/analytics endpoint.

What to check: Never send a body with 204. Clients that try to parse JSON from it will fail.

HTTP/1.1 204 No Content

Defined in RFC 9110

Success, and the client should reset the form or view that sent the request.

Common causes: Form submissions that should clear the inputs.

What to check: Seldom used - most apps reset forms in JavaScript instead. No body is allowed.

HTTP/1.1 205 Reset Content

Defined in RFC 9110

The server is sending only the byte range the client asked for.

Common causes: Video seeking, resumable downloads, and download managers using Range requests.

What to check: Check Content-Range matches the bytes sent and that Accept-Ranges: bytes is advertised.

HTTP/1.1 206 Partial Content
Content-Range: bytes 0-1023/146515
Content-Length: 1024
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

WebDAV: the body holds a separate status for each of several resources.

Common causes: WebDAV PROPFIND and batch operations.

What to check: Parse the XML body - individual items can fail even though the overall code is 2xx.

HTTP/1.1 207 Multi-Status
Content-Type: application/xml; charset=utf-8

Defined in RFC 4918

WebDAV: members of this binding were already listed earlier in the same response.

Common causes: WebDAV bindings that would otherwise repeat the same resource.

What to check: Only meaningful inside a 207 Multi-Status body.

HTTP/1.1 208 Already Reported
Content-Type: text/plain; charset=utf-8

Defined in RFC 5842

The server applied delta encoding (instance manipulations) to the response.

Common causes: HTTP delta encoding with A-IM / IM headers.

What to check: Extremely rare in practice.

HTTP/1.1 226 IM Used
Content-Type: text/plain; charset=utf-8

Defined in RFC 3229

Several representations are available and the client should pick one.

Common causes: Content negotiation that the server will not resolve itself.

What to check: Rare. Usually better to choose a default and return 200, or redirect with 302.

HTTP/1.1 300 Multiple Choices
Content-Length: 0

Defined in RFC 9110

The resource has a new permanent URL. Search engines transfer ranking to it.

Common causes: Domain moves, HTTP to HTTPS, renamed pages, trailing-slash normalization.

What to check: Browsers may change POST to GET when following it - use 308 if the method must be kept. Browsers cache 301s aggressively.

HTTP/1.1 301 Moved Permanently
Location: /new-path/

Defined in RFC 9110

The resource is temporarily at another URL. Clients keep using the original URL.

Common causes: Login redirects, A/B tests, temporary maintenance pages.

What to check: For a permanent move use 301 or 308. If the method must stay POST, use 307.

HTTP/1.1 302 Found
Location: /login?next=/account

Defined in RFC 9110

Fetch the result from another URL with GET.

Common causes: Post/Redirect/Get: after a form POST, send the browser to a results page.

What to check: The client always switches to GET. Use it to stop the "resubmit form?" warning on refresh.

HTTP/1.1 303 See Other
Location: /orders/1042

Defined in RFC 9110

The cached copy is still valid, so no body is sent.

Common causes: A conditional request with If-None-Match or If-Modified-Since that matched.

What to check: Make sure ETag or Last-Modified are stable. A changing ETag means 304s never happen.

HTTP/1.1 304 Not Modified
ETag: "33a64df5"
Cache-Control: max-age=3600

Defined in RFC 9110

Deprecated. It once told clients to use a proxy given in Location.

Common causes: Legacy systems only - modern browsers ignore it for security reasons.

What to check: Do not use.

HTTP/1.1 305 Use Proxy
Content-Length: 0

Defined in RFC 9110

Reserved. It was used in an earlier draft of HTTP/1.1 and must not be used again.

Common causes: Never sent by conforming servers.

What to check: If you see it, the server is misconfigured or nonstandard.

HTTP/1.1 306 Unused
Content-Length: 0

Defined in RFC 9110

Temporarily at another URL, and the client must repeat the same method and body.

Common causes: Temporary redirects of POST or PUT requests, and HSTS internal redirects in browsers.

What to check: Use 307 instead of 302 whenever the method must not change to GET.

HTTP/1.1 307 Temporary Redirect
Location: /api/v2/upload

Defined in RFC 9110

Permanently moved, and the client must repeat the same method and body.

Common causes: Permanent moves of API endpoints and form targets. Cloudflare Pages uses it for clean URLs.

What to check: Like 301 but method-preserving. Cached aggressively, so test before deploying.

HTTP/1.1 308 Permanent Redirect
Location: /api/v2/orders

Defined in RFC 9110

The server cannot process the request because it is malformed.

Common causes: Invalid JSON, missing required fields, a bad query string, an oversized or corrupt cookie.

What to check: Return a body explaining which field is wrong. Clear cookies if a browser keeps getting 400.

HTTP/1.1 400 Bad Request
Content-Type: application/problem+json

Defined in RFC 9110

Authentication is missing or invalid. Despite the name, it means "unauthenticated".

Common causes: No token, an expired token, a wrong API key, or a bad password.

What to check: A 401 must include WWW-Authenticate. If the user is logged in but not allowed, use 403.

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api", error="invalid_token"
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

Reserved for future use; some APIs use it for billing problems.

Common causes: Expired subscriptions or exhausted credits in SaaS APIs.

What to check: Nonstandard meaning varies by API - read the response body.

HTTP/1.1 402 Payment Required
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

The server understood who you are and refuses the request.

Common causes: Missing permissions, file system permissions, WAF or bot blocking, IP allowlists, CSRF failures.

What to check: Check the user's role, file permissions, and firewall rules. Use 404 instead if revealing that the resource exists is a risk.

HTTP/1.1 403 Forbidden
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

Nothing exists at this URL, or the server will not say whether it does.

Common causes: Typos, deleted pages, broken links, wrong API routes, case-sensitive paths.

What to check: Redirect moved pages with 301, use 410 for content removed on purpose, and serve a helpful 404 page.

HTTP/1.1 404 Not Found
Content-Type: text/html; charset=utf-8

Defined in RFC 9110

The URL exists but does not support this HTTP method.

Common causes: POST to a GET-only route, a missing CORS preflight handler, or a static host receiving POST.

What to check: The response must include an Allow header listing the supported methods.

HTTP/1.1 405 Method Not Allowed
Allow: GET, HEAD
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

The server cannot produce a response matching the Accept headers.

Common causes: A client demanding Accept: application/xml from a JSON-only API.

What to check: Loosen the Accept header, or have the server fall back to a default type.

HTTP/1.1 406 Not Acceptable
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

Like 401, but the client must authenticate with a proxy.

Common causes: Corporate proxies requiring credentials.

What to check: Configure proxy credentials. The proxy sends Proxy-Authenticate.

HTTP/1.1 407 Proxy Authentication Required
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

The server gave up waiting for the client to finish sending the request.

Common causes: Slow uploads, idle keep-alive connections, poor mobile networks.

What to check: Safe to retry. Servers often send it before closing idle connections.

HTTP/1.1 408 Request Timeout
Connection: close
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

The request conflicts with the current state of the resource.

Common causes: Duplicate unique keys, edit conflicts, version mismatches.

What to check: Explain the conflict in the body so the client can resolve it and retry.

HTTP/1.1 409 Conflict
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

The resource was removed on purpose and will not return.

Common causes: Discontinued products, deleted accounts, retired API versions.

What to check: Search engines drop 410 pages faster than 404. Do not use it for temporary removals.

HTTP/1.1 410 Gone
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

The server requires a Content-Length header.

Common causes: A POST without Content-Length to a server that rejects chunked bodies.

What to check: Send Content-Length, or use a server that accepts chunked transfer encoding.

HTTP/1.1 411 Length Required
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

A conditional header such as If-Match did not match the current resource.

Common causes: Optimistic locking: someone else changed the resource since you read it.

What to check: Fetch the latest version and its ETag, then retry the update.

HTTP/1.1 412 Precondition Failed
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

The request body is larger than the server allows (formerly "Payload Too Large").

Common causes: Uploads over the limit, such as nginx client_max_body_size or a platform request cap.

What to check: Raise the server limit or upload in chunks. Retry-After may say when to try again.

HTTP/1.1 413 Content Too Large
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

The URL is longer than the server will process.

Common causes: Huge query strings, redirect loops that keep appending parameters.

What to check: Send large data in a POST body instead of the query string.

HTTP/1.1 414 URI Too Long
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

The server will not accept the request body format.

Common causes: A missing or wrong Content-Type, such as text/plain sent to a JSON API.

What to check: Set Content-Type: application/json (or the type the API expects).

HTTP/1.1 415 Unsupported Media Type
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

The requested byte range is outside the file.

Common causes: Resuming a download of a file that has since changed or shrunk.

What to check: Restart the download without Range. The server should send Content-Range: bytes */length.

HTTP/1.1 416 Range Not Satisfiable
Content-Range: bytes */146515
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

The server cannot meet the Expect request header.

Common causes: Expect: 100-continue sent to a server or proxy that does not support it.

What to check: Remove the Expect header and send the body directly.

HTTP/1.1 417 Expectation Failed
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

Reserved. It comes from an April Fools RFC and is not a real HTTP status.

Common causes: Easter eggs, and some sites using it to answer bots.

What to check: Do not use it in real APIs. RFC 9110 reserves the number so nothing else claims it.

HTTP/1.1 418 Unused
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

The request reached a server that cannot answer for this host.

Common causes: HTTP/2 connection reuse across hosts that share a certificate but not a backend.

What to check: Clients should retry on a new connection. Check virtual host and certificate setup.

HTTP/1.1 421 Misdirected Request
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

The request is well-formed, but its content fails validation.

Common causes: Valid JSON with invalid values: a bad email, an end date before the start date.

What to check: Return field-level errors. Many APIs use 400 for malformed and 422 for invalid data.

HTTP/1.1 422 Unprocessable Content
Content-Type: application/problem+json

Defined in RFC 9110

WebDAV: the resource is locked.

Common causes: Editing a WebDAV file that another user has locked.

What to check: Wait for the lock to be released or use the lock token.

HTTP/1.1 423 Locked
Content-Type: text/plain; charset=utf-8

Defined in RFC 4918

WebDAV: the request failed because an earlier request it depended on failed.

Common causes: Batch WebDAV operations where one step failed.

What to check: Fix the first failure in the batch.

HTTP/1.1 424 Failed Dependency
Content-Type: text/plain; charset=utf-8

Defined in RFC 4918

The server will not process a request that might be replayed.

Common causes: TLS 1.3 early data (0-RTT) on non-idempotent requests.

What to check: Clients retry automatically after the handshake completes.

HTTP/1.1 425 Too Early
Content-Type: text/plain; charset=utf-8

Defined in RFC 8470

The server refuses the current protocol; the client must upgrade.

Common causes: Servers requiring TLS or a newer HTTP version.

What to check: The response includes Upgrade with the required protocol.

HTTP/1.1 426 Upgrade Required
Upgrade: HTTP/2.0
Connection: Upgrade
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

The server requires a conditional request, such as If-Match.

Common causes: APIs that enforce optimistic locking to prevent lost updates.

What to check: Read the resource, then send its ETag in If-Match.

HTTP/1.1 428 Precondition Required
Content-Type: text/plain; charset=utf-8

Defined in RFC 6585

The client sent too many requests in a given time (rate limiting).

Common causes: API rate limits, login throttling, bots, retry loops without backoff.

What to check: Honor Retry-After and use exponential backoff with jitter. Check X-RateLimit headers.

HTTP/1.1 429 Too Many Requests
Retry-After: 60
Content-Type: text/plain; charset=utf-8

Defined in RFC 6585

The headers - often cookies - are too large.

Common causes: Huge or accumulated cookies, oversized Authorization tokens.

What to check: Clear cookies for the site and keep tokens small.

HTTP/1.1 431 Request Header Fields Too Large
Content-Type: text/plain; charset=utf-8

Defined in RFC 6585

The resource is blocked for legal reasons.

Common causes: Court orders, government censorship, DMCA takedowns, geo-blocking for legal compliance.

What to check: The response should identify who imposed the block, in a Link header with rel="blocked-by".

HTTP/1.1 451 Unavailable For Legal Reasons
Content-Type: text/plain; charset=utf-8

Defined in RFC 7725

A generic error: the server hit an unexpected condition.

Common causes: Unhandled exceptions, misconfiguration, crashed code, database errors.

What to check: Check the server and application logs at the time of the request. Never expose stack traces to users.

HTTP/1.1 500 Internal Server Error
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

The server does not support the method or functionality required.

Common causes: Unknown HTTP methods, unfinished API endpoints.

What to check: Use 405 when the method is known but not allowed on this URL.

HTTP/1.1 501 Not Implemented
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

A gateway or proxy got an invalid response from the server behind it.

Common causes: The app server crashed or restarted, wrong upstream port, protocol mismatch, a dropped connection.

What to check: Check that the upstream process is running and listening, and read the proxy error log.

HTTP/1.1 502 Bad Gateway
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

The server is temporarily unable to handle the request.

Common causes: Maintenance, overload, or an exhausted connection pool.

What to check: Send Retry-After. For planned maintenance, 503 tells search engines not to deindex the page.

HTTP/1.1 503 Service Unavailable
Retry-After: 120
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

A gateway or proxy did not get a response from the upstream server in time.

Common causes: Slow database queries, long-running requests, an upstream that hangs.

What to check: Speed up the slow request, move long work to a background job (202), or raise the proxy timeout.

HTTP/1.1 504 Gateway Timeout
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

The server does not support the HTTP version used.

Common causes: Very old or very new protocol versions, malformed request lines.

What to check: Check the client and any proxies for protocol settings.

HTTP/1.1 505 HTTP Version Not Supported
Content-Type: text/plain; charset=utf-8

Defined in RFC 9110

A content-negotiation configuration error created a loop.

Common causes: Misconfigured transparent content negotiation.

What to check: A server configuration bug - fix the variant setup.

HTTP/1.1 506 Variant Also Negotiates
Content-Type: text/plain; charset=utf-8

Defined in RFC 2295

WebDAV: the server cannot store what is needed to complete the request.

Common causes: A full disk or quota on a WebDAV or file server.

What to check: Free space or raise the quota.

HTTP/1.1 507 Insufficient Storage
Content-Type: text/plain; charset=utf-8

Defined in RFC 4918

WebDAV: the server found an infinite loop while processing the request.

Common causes: Recursive bindings in WebDAV collections.

What to check: Fix the recursive structure.

HTTP/1.1 508 Loop Detected
Content-Type: text/plain; charset=utf-8

Defined in RFC 5842

Further extensions to the request are required (historic).

Common causes: The HTTP Extension Framework, which is now obsolete.

What to check: Practically never seen.

HTTP/1.1 510 Not Extended
Content-Type: text/plain; charset=utf-8

Defined in RFC 2774

The client must sign in to the network before it can browse.

Common causes: Captive portals on hotel, airport, and cafe Wi-Fi.

What to check: Open any http:// page to reach the portal login.

HTTP/1.1 511 Network Authentication Required
Content-Type: text/plain; charset=utf-8

Defined in RFC 6585

nginx closed the connection without sending anything.

Common causes: nginx return 444; rules used to drop bots and unwanted hosts.

What to check: Visible only in nginx logs - clients see a dropped connection.

HTTP/1.1 444 No Response
Content-Type: text/plain; charset=utf-8

Defined in nginx

The client closed the connection before the load balancer idle timeout.

Common causes: Client timeouts shorter than the backend response time.

What to check: Compare client and target response times; raise the client timeout.

HTTP/1.1 460 Client Closed Connection
Content-Type: text/plain; charset=utf-8

Defined in AWS

X-Forwarded-For contained more than 30 IP addresses.

Common causes: Proxy chains or loops that keep appending to X-Forwarded-For.

What to check: Find the proxy loop or trim the header upstream.

HTTP/1.1 463 Too Many Forwarded IPs
Content-Type: text/plain; charset=utf-8

Defined in AWS

nginx rejected request headers larger than its buffers.

Common causes: Big cookies or tokens over large_client_header_buffers.

What to check: Shrink cookies or raise large_client_header_buffers.

HTTP/1.1 494 Request Header Too Large
Content-Type: text/plain; charset=utf-8

Defined in nginx

The client certificate failed verification.

Common causes: Mutual TLS with an invalid or untrusted client certificate.

What to check: Check the client certificate chain and ssl_client_certificate.

HTTP/1.1 495 SSL Certificate Error
Content-Type: text/plain; charset=utf-8

Defined in nginx

Mutual TLS is required but the client sent no certificate.

Common causes: ssl_verify_client on, and a browser or client without a certificate.

What to check: Install a client certificate, or make verification optional.

HTTP/1.1 496 SSL Certificate Required
Content-Type: text/plain; charset=utf-8

Defined in nginx

A plain HTTP request reached a port that expects HTTPS.

Common causes: Calling http://host:443 or a misconfigured load balancer.

What to check: Use https://, or redirect with error_page 497.

HTTP/1.1 497 HTTP Request Sent to HTTPS Port
Content-Type: text/plain; charset=utf-8

Defined in nginx

The client closed the connection before nginx could respond.

Common causes: Users navigating away, client timeouts shorter than the upstream response time.

What to check: Appears only in logs. Many 499s usually mean slow upstream responses.

HTTP/1.1 499 Client Closed Request
Content-Type: text/plain; charset=utf-8

Defined in nginx

The origin returned an empty, unknown, or unexpected response.

Common causes: Origin crashes, empty replies, oversized headers, connection resets.

What to check: Check origin logs at the request time. Cloudflare passes the origin's problem through.

HTTP/1.1 520 Web Server Returned an Unknown Error
Content-Type: text/plain; charset=utf-8

Defined in Cloudflare

The origin refused the connection.

Common causes: The web server is stopped, or a firewall blocks Cloudflare IP ranges.

What to check: Start the server and allowlist Cloudflare IP ranges.

HTTP/1.1 521 Web Server Is Down
Content-Type: text/plain; charset=utf-8

Defined in Cloudflare

Cloudflare could not complete a TCP connection to the origin in time.

Common causes: Overloaded origin, wrong origin IP in DNS, dropped packets, firewall.

What to check: Verify the DNS origin IP and that the server accepts connections on 80/443.

HTTP/1.1 522 Connection Timed Out
Content-Type: text/plain; charset=utf-8

Defined in Cloudflare

Cloudflare cannot route to the origin.

Common causes: Wrong DNS record, origin IP changed, network routing problems.

What to check: Check the A/AAAA records point at the current origin.

HTTP/1.1 523 Origin Is Unreachable
Content-Type: text/plain; charset=utf-8

Defined in Cloudflare

Cloudflare connected, but the origin did not send a response within 100 seconds.

Common causes: Long-running requests: reports, exports, slow queries.

What to check: Move long work to a background job and poll, or return data faster.

HTTP/1.1 524 A Timeout Occurred
Content-Type: text/plain; charset=utf-8

Defined in Cloudflare

The TLS handshake between Cloudflare and the origin failed.

Common causes: No certificate on the origin, cipher mismatch, SNI not supported.

What to check: Install a valid certificate at the origin for SSL mode Full or Full (strict).

HTTP/1.1 525 SSL Handshake Failed
Content-Type: text/plain; charset=utf-8

Defined in Cloudflare

The origin certificate is invalid in Full (strict) mode.

Common causes: Expired, self-signed, or wrong-hostname origin certificates.

What to check: Use a valid public certificate or a Cloudflare Origin CA certificate.

HTTP/1.1 526 Invalid SSL Certificate
Content-Type: text/plain; charset=utf-8

Defined in Cloudflare

Returned together with a Cloudflare 1xxx error, usually an origin DNS problem.

Common causes: The origin hostname does not resolve, or a 1016 Origin DNS error.

What to check: Read the 1xxx error number on the page and fix the origin DNS record.

HTTP/1.1 530 Origin DNS Error
Content-Type: text/plain; charset=utf-8

Defined in Cloudflare