HTTP Status Codes

How to look up an HTTP status code

1. Type a code or a word in the search box.
2. Or choose a group such as 4xx.
3. Read the meaning and what to do.

1xx Informational

The request was received and the server is still working. You rarely see these.

100 Continue (RFC 9110). The server has received the start of the request and the client should carry on and send the rest. Nothing to do. Clients that send large bodies use this to check the server will accept them first.

101 Switching Protocols (RFC 9110). The server agrees to change to the protocol the client asked for, such as WebSocket. Nothing to do. This is the normal first step of a WebSocket connection.

102 Processing (RFC 2518). The server has the request and is still working on it, so the client should not time out. Used by WebDAV. Wait. A final answer will follow.

103 Early Hints (RFC 8297). The server sends a few headers early, such as links to files the page will need, while it prepares the full answer. Nothing to do. Browsers use it to start loading files sooner.

2xx Success

The request worked.

200 OK (RFC 9110). The request worked. What you get back depends on the method: a page for GET, the result for POST. Nothing to do.

201 Created (RFC 9110). The request worked and a new thing now exists. The Location header usually says where. Nothing to do. This is the right answer to a successful POST that creates something.

202 Accepted (RFC 9110). The server has accepted the request but has not finished it. It may still fail later. Check back later, or use the link the server gives for the job's status.

203 Non-Authoritative Information (RFC 9110). The request worked, but a proxy changed the answer, so it may differ from what the original server sent. Usually nothing. Check the proxy if the content looks wrong.

204 No Content (RFC 9110). The request worked and there is nothing to send back. Nothing to do. Common after saving or deleting something.

205 Reset Content (RFC 9110). The request worked and the client should clear the form or view it came from. Clear the form. Rarely used.

206 Partial Content (RFC 9110). The server is sending only the part of the file that was asked for with a Range header. Nothing to do. Video players and download tools use this to seek and resume.

207 Multi-Status (RFC 4918). The answer holds several separate results, one for each item in the request. Used by WebDAV. Read each result inside the body, because some may have failed.

208 Already Reported (RFC 5842). Items already listed earlier in the same answer are not listed again. Used by WebDAV. Nothing to do.

226 IM Used (RFC 3229). The server answered with the result of one or more instance manipulations, such as a delta from an earlier copy. Nothing to do. Rarely seen.

3xx Redirection

The thing you asked for is somewhere else, or you already have it.

300 Multiple Choices (RFC 9110). There is more than one possible answer and the client or user should pick one. Choose one of the links the server lists. Rarely used.

301 Moved Permanently (RFC 9110). The page has a new address for good. Browsers and search engines should use the new one from now on. Update your links to the Location address. Use this when you rename or move a page.

302 Found (RFC 9110). The page is at another address for now. Keep using the original address in future. Follow the Location header. Use 307 if the method must not change.

303 See Other (RFC 9110). The result is at another address and should be fetched with GET. Often used after a form submission. Follow the Location header with a GET request.

304 Not Modified (RFC 9110). Your saved copy is still current, so the server sends no body and the browser reuses its cache. Nothing to do. This makes repeat visits faster.

305 Use Proxy (RFC 9110). Deprecated. The server wanted the client to use a proxy. Do not use. Browsers ignore it for safety.

306 (Unused) (RFC 9110). Reserved. It once meant Switch Proxy and is no longer used. Do not use.

307 Temporary Redirect (RFC 9110). The page is at another address for now, and the method and body must stay the same. Repeat the same request at the Location address.

308 Permanent Redirect (RFC 9110). The page has a new address for good, and the method and body must stay the same. Repeat the same request at the Location address and update stored links.

4xx Client error

The request has a problem. Fix the request and try again.

400 Bad Request (RFC 9110). The server could not understand the request because it is malformed, for example bad syntax, a broken cookie or a wrong header. Check the request: the URL, the headers and the body. Clearing cookies often fixes it in a browser.

401 Unauthorized (RFC 9110). The request needs valid sign-in details. Despite the name, this is about who you are (authentication). Sign in or send a valid token or key. The WWW-Authenticate header says how.

402 Payment Required (RFC 9110). Reserved for future use. A few services use it to say a payment is due. Check the service's own documentation.

403 Forbidden (RFC 9110). The server understood the request but will not allow it. Signing in again will not help if your account lacks permission. Ask for access, or check file permissions and firewall rules on the server.

404 Not Found (RFC 9110). The server cannot find anything at this address. It may never have existed, or it may have been removed. Check the address for typos. If you moved the page, add a 301 redirect.

405 Method Not Allowed (RFC 9110). The address exists but does not accept this method, such as POST to a page that only allows GET. Use a method listed in the Allow header.

406 Not Acceptable (RFC 9110). The server cannot produce an answer in any of the formats the client said it accepts. Check the Accept headers in the request.

407 Proxy Authentication Required (RFC 9110). Like 401, but the sign-in is needed for a proxy between you and the server. Send valid proxy credentials.

408 Request Timeout (RFC 9110). The server gave up waiting for the client to finish sending the request. Try again. Check for a slow or unreliable connection.

409 Conflict (RFC 9110). The request clashes with the current state of the thing, such as editing a record someone else changed. Fetch the latest version, resolve the difference, and send the request again.

410 Gone (RFC 9110). The page used to exist and has been removed on purpose, with no new address. Remove links to it. Search engines treat this as a firm sign to drop the page.

411 Length Required (RFC 9110). The server needs a Content-Length header and the request did not have one. Add a Content-Length header.

412 Precondition Failed (RFC 9110). A condition in the request headers, such as If-Match, was not true on the server. Fetch the current version and try again.

413 Content Too Large (RFC 9110). The request body is bigger than the server is willing to accept. It used to be called Payload Too Large. Send a smaller file, or raise the upload limit on the server.

414 URI Too Long (RFC 9110). The address is longer than the server will accept. Shorten the URL, or send the data in a POST body instead of the query string.

415 Unsupported Media Type (RFC 9110). The server does not accept the format of the data sent, such as JSON where it expects a form. Check the Content-Type header and the format of the body.

416 Range Not Satisfiable (RFC 9110). The part of the file asked for with a Range header lies outside the file. Ask for a range that exists, or fetch the whole file.

417 Expectation Failed (RFC 9110). The server cannot meet the requirement in the Expect header. Remove the Expect header and send the request again.

418 I'm a teapot (RFC 2324). A joke from the Hyper Text Coffee Pot Control Protocol. A teapot refuses to make coffee. Some sites use it on purpose to turn away bots. Nothing to fix. It usually means the site is joking or blocking you.

421 Misdirected Request (RFC 9110). The request went to a server that cannot answer for that host name. Open a new connection to the right host. Often seen with shared HTTP/2 connections.

422 Unprocessable Content (RFC 9110). The request is well formed but its content does not make sense, such as a field that fails validation. Read the error details in the body and correct the data.

423 Locked (RFC 4918). The thing you are changing is locked. Used by WebDAV. Wait for the lock to end, or unlock it if it is yours.

424 Failed Dependency (RFC 4918). The request failed because an earlier request it depended on failed. Used by WebDAV. Fix the earlier failure first.

425 Too Early (RFC 8470). The server will not process a request that might be replayed, such as one sent in TLS early data. Send it again after the secure connection is fully set up.

426 Upgrade Required (RFC 9110). The server will only answer if the client switches to another protocol, named in the Upgrade header. Use the protocol the server asks for, often a newer TLS version.

428 Precondition Required (RFC 6585). The server insists the request be conditional, to avoid overwriting someone else's changes. Add an If-Match header with the version you last saw.

429 Too Many Requests (RFC 6585). You have sent too many requests in a short time (rate limiting). Slow down and retry after the time in the Retry-After header.

431 Request Header Fields Too Large (RFC 6585). The headers, often a very large cookie, are too big for the server. Clear cookies for the site or send fewer headers.

451 Unavailable For Legal Reasons (RFC 7725). The page is blocked because of a legal demand, such as a court order. The number nods to the book Fahrenheit 451. Nothing you can change. The response may name who blocked it.

499 Client Closed Request (Unofficial (nginx)). Nginx records this in its log when the client closed the connection before the server answered. It is never sent to a client. Look for slow responses that make users give up.

5xx Server error

The request looks fine, but the server failed to handle it.

500 Internal Server Error (RFC 9110). Something went wrong on the server and it has no more specific answer. It is a general fault. Try again later. If you run the site, read the server error log for the cause.

501 Not Implemented (RFC 9110). The server does not support what the request needs, such as an unknown method. Use a method the server supports.

502 Bad Gateway (RFC 9110). A server acting as a gateway or proxy got an invalid answer from the server behind it. Try again. If you run the site, check that the application server behind the proxy is running.

503 Service Unavailable (RFC 9110). The server cannot handle the request right now, usually because it is overloaded or down for maintenance. Try again later. A Retry-After header may say when.

504 Gateway Timeout (RFC 9110). A gateway or proxy waited too long for the server behind it to answer. Try again. If you run the site, look for a slow database or application.

505 HTTP Version Not Supported (RFC 9110). The server does not support the version of HTTP used in the request. Use an HTTP version the server supports, such as HTTP/1.1.

506 Variant Also Negotiates (RFC 2295). A server setup error in content negotiation: the chosen variant is itself set up to negotiate. The site owner must fix the server configuration.

507 Insufficient Storage (RFC 4918). The server has no room to store what the request needs. Used by WebDAV. Free up space on the server.

508 Loop Detected (RFC 5842). The server found an endless loop while processing the request. Used by WebDAV. The site owner must fix the circular reference.

510 Not Extended (RFC 2774). The server needs more extensions in the request before it can answer. Rarely used. Add the extension information the server asks for.

511 Network Authentication Required (RFC 6585). You must sign in to the network first, as on a hotel or airport Wi-Fi login page. Open any web page and complete the network sign-in.

520 Web Server Returned an Unknown Error (Unofficial (Cloudflare)). Cloudflare got an empty or unexpected answer from the site's own server. Check the origin server's logs for crashes or blocked requests.

521 Web Server Is Down (Unofficial (Cloudflare)). Cloudflare could not connect because the site's own server refused the connection. Make sure the origin server is running and allows Cloudflare's addresses.

522 Connection Timed Out (Unofficial (Cloudflare)). Cloudflare could not complete a connection to the site's own server in time. Check the origin server's load and firewall.

523 Origin Is Unreachable (Unofficial (Cloudflare)). Cloudflare could not reach the site's own server, often because of a wrong address in DNS. Check the DNS record and routing to the origin.

524 A Timeout Occurred (Unofficial (Cloudflare)). The connection worked, but the site's own server took too long to answer. Speed up the slow request, or run it as a background job.

525 SSL Handshake Failed (Unofficial (Cloudflare)). Cloudflare could not set up a secure connection with the site's own server. Check the origin server's certificate and TLS settings.

526 Invalid SSL Certificate (Unofficial (Cloudflare)). Cloudflare could not trust the certificate on the site's own server. Install a valid certificate on the origin server.

About this tool

Find out what a status code such as 404, 301 or 503 means and what to do about it. The list covers every code in RFC 9110, plus other codes from later standards and a few that servers use without one, each with a plain explanation. Search by number, name or a few words, or filter by group. The full list is also written out below, so you can read it without JavaScript.

Common questions