{ "dataset": "http-status-codes", "title": "HTTP status codes", "version": "2.0.0", "updated": "2026-08-05", "source": { "name": "IANA HTTP Status Code Registry", "url": "https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml" }, "secondarySources": [ { "name": "RFC 9110, HTTP Semantics", "url": "https://www.rfc-editor.org/rfc/rfc9110.html" } ], "checkedAt": "2026-08-05", "license": "CC BY 4.0", "licenseUrl": "https://creativecommons.org/licenses/by/4.0/", "attribution": "Data from quickref.tips", "documentation": "https://quickref.tips/http-status-codes", "recordCount": 74, "data": [ { "code": 100, "name": "Continue", "desc": "Keep going. The server has read the request headers and wants the body.", "kind": "registered", "spec": "[RFC9110, Section 15.2.1]" }, { "code": 101, "name": "Switching Protocols", "desc": "The server is switching to another protocol, such as WebSocket, as the client asked.", "kind": "registered", "spec": "[RFC9110, Section 15.2.2]" }, { "code": 102, "name": "Processing", "desc": "The server is still working on a long running request and has not finished.", "kind": "registered", "spec": "[RFC2518]" }, { "code": 103, "name": "Early Hints", "desc": "Early hints, sent before the real response so the browser can start preloading.", "kind": "registered", "spec": "[RFC8297]" }, { "code": 104, "name": "Upload Resumption Supported", "desc": "Provisional. Signals that the server supports resumable uploads.", "kind": "provisional", "spec": "[draft-ietf-httpbis-resumable-upload-05]" }, { "code": 200, "name": "OK", "desc": "It worked. What that means depends on the method: a body for GET, a result for POST.", "kind": "registered", "spec": "[RFC9110, Section 15.3.1]" }, { "code": 201, "name": "Created", "desc": "It worked and something new exists. The Location header points at it.", "kind": "registered", "spec": "[RFC9110, Section 15.3.2]" }, { "code": 202, "name": "Accepted", "desc": "Accepted for processing, but not done yet. Nothing is guaranteed about the outcome.", "kind": "registered", "spec": "[RFC9110, Section 15.3.3]" }, { "code": 203, "name": "Non-Authoritative Information", "desc": "It worked, but a proxy changed the response on the way, so treat it with care.", "kind": "registered", "spec": "[RFC9110, Section 15.3.4]" }, { "code": 204, "name": "No Content", "desc": "It worked and there is deliberately no body to send back.", "kind": "registered", "spec": "[RFC9110, Section 15.3.5]" }, { "code": 205, "name": "Reset Content", "desc": "It worked, and the client should clear the form or view that sent the request.", "kind": "registered", "spec": "[RFC9110, Section 15.3.6]" }, { "code": 206, "name": "Partial Content", "desc": "Part of the resource, because the request asked for a byte range.", "kind": "registered", "spec": "[RFC9110, Section 15.3.7]" }, { "code": 207, "name": "Multi-Status", "desc": "A body containing several separate status codes, one per sub operation. WebDAV.", "kind": "registered", "spec": "[RFC4918]" }, { "code": 208, "name": "Already Reported", "desc": "A member of a collection was already reported earlier in this response. WebDAV.", "kind": "registered", "spec": "[RFC5842]" }, { "code": 226, "name": "IM Used", "desc": "The response is the result of applying instance manipulations to the resource.", "kind": "registered", "spec": "[RFC3229]" }, { "code": 300, "name": "Multiple Choices", "desc": "Several representations exist and the client has to pick one.", "kind": "registered", "spec": "[RFC9110, Section 15.4.1]" }, { "code": 301, "name": "Moved Permanently", "desc": "This URL has moved for good. Update your links.", "kind": "registered", "spec": "[RFC9110, Section 15.4.2]", "commonCauses": [ "A page was moved and a permanent redirect was configured for the old URL.", "A site enforces a canonical host, such as apex to www, or http to https.", "A trailing slash convention rewrites one URL form to the other." ], "howToFix": "Nothing, if the redirect is intended. If you are the one linking, update the link to the target so the hop disappears: clients and crawlers both cache a 301, and a chain of them costs latency on every request.", "confusedWith": [ 302, 308 ] }, { "code": 302, "name": "Found", "desc": "This URL is temporarily somewhere else. Keep using the original.", "kind": "registered", "spec": "[RFC9110, Section 15.4.3]", "commonCauses": [ "A framework default redirect after a login or a form submission.", "A temporary maintenance page or A/B split.", "A legacy handler that was meant to be permanent but was never changed to 301." ], "howToFix": "Decide whether the move is temporary. If it is permanent, return 301 or 308 instead, because a 302 tells search engines to keep indexing the original URL. If the method must survive the redirect, use 307.", "confusedWith": [ 301, 307 ] }, { "code": 303, "name": "See Other", "desc": "Look at a different URL with GET, typically after a form post.", "kind": "registered", "spec": "[RFC9110, Section 15.4.4]" }, { "code": 304, "name": "Not Modified", "desc": "Nothing changed. Use the copy you already have in cache.", "kind": "registered", "spec": "[RFC9110, Section 15.4.5]", "commonCauses": [ "The client sent If-None-Match and the ETag still matches.", "The client sent If-Modified-Since and the resource has not changed." ], "howToFix": "This is the success case for caching, not an error. If you are seeing stale content, the cause is the caching headers on the original response, not the 304 itself.", "confusedWith": [ 200, 412 ] }, { "code": 305, "name": "Use Proxy", "desc": "Deprecated. Told the client to use a proxy, and is no longer used.", "kind": "obsoleted", "spec": "[RFC9110, Section 15.4.6]" }, { "code": 306, "name": "(Unused)", "desc": "Reserved. Was defined in an earlier specification and is no longer used.", "kind": "unused", "spec": "[RFC9110, Section 15.4.7]" }, { "code": 307, "name": "Temporary Redirect", "desc": "Temporarily elsewhere, and the method must not change. The strict form of 302.", "kind": "registered", "spec": "[RFC9110, Section 15.4.8]" }, { "code": 308, "name": "Permanent Redirect", "desc": "Permanently elsewhere, and the method must not change. The strict form of 301.", "kind": "registered", "spec": "[RFC9110, Section 15.4.9]" }, { "code": 400, "name": "Bad Request", "desc": "The request itself is malformed and the server will not try to interpret it.", "kind": "registered", "spec": "[RFC9110, Section 15.5.1]", "commonCauses": [ "Malformed JSON, or a body that does not match the declared Content-Type.", "A query parameter of the wrong type, such as a word where a number is required.", "A header the server cannot parse, sometimes from a stray newline in a generated value." ], "howToFix": "Log and inspect the raw request, not your intent for it. Most 400s come from a serialiser producing something slightly different from what you assumed. If the syntax is valid and only the content is wrong, the correct code is 422.", "confusedWith": [ 422 ] }, { "code": 401, "name": "Unauthorized", "desc": "The server does not know who you are. Authenticate and try again.", "kind": "registered", "spec": "[RFC9110, Section 15.5.2]", "commonCauses": [ "No Authorization header was sent at all.", "A token has expired, or was signed with a key the server no longer accepts.", "The credentials are for a different environment than the one you are calling." ], "howToFix": "Authenticate and retry. A correct 401 carries a WWW-Authenticate header telling you which scheme to use. If retrying with valid credentials still fails, the server means 403 and is using the wrong code.", "confusedWith": [ 403 ] }, { "code": 402, "name": "Payment Required", "desc": "Reserved for payment. Rarely implemented, and never in a standard way.", "kind": "registered", "spec": "[RFC9110, Section 15.5.3]" }, { "code": 403, "name": "Forbidden", "desc": "The server knows who you are and is refusing anyway.", "kind": "registered", "spec": "[RFC9110, Section 15.5.4]", "commonCauses": [ "The authenticated user lacks the role or scope the endpoint requires.", "A firewall, WAF, or bot rule rejected the request before it reached the application.", "The resource exists but belongs to another tenant or account." ], "howToFix": "Logging in again will not help, so check permissions rather than credentials. If the server would rather not reveal that the resource exists, 404 is the deliberate alternative.", "confusedWith": [ 401, 404 ] }, { "code": 404, "name": "Not Found", "desc": "The server has no resource at that URL and will not say whether it ever did.", "kind": "registered", "spec": "[RFC9110, Section 15.5.5]", "commonCauses": [ "The path is wrong, often a typo or a stale link.", "The resource was deleted and nothing was left in its place.", "A route exists in development but was not deployed, or a rewrite rule is missing." ], "howToFix": "Check the exact path, including case and trailing slash. If the resource genuinely used to exist and is gone for good, 410 is more informative to clients and crawlers. If it moved, 301 to the new URL.", "confusedWith": [ 410, 403 ] }, { "code": 405, "name": "Method Not Allowed", "desc": "The URL exists but not with that method. Check the Allow header.", "kind": "registered", "spec": "[RFC9110, Section 15.5.6]", "commonCauses": [ "A POST sent to an endpoint that only defines GET.", "A preflight or a proxy rewrote the method.", "A route matches the path but registers a different method." ], "howToFix": "Read the Allow header in the response: a correct 405 must list the methods the URL does support.", "confusedWith": [ 404, 501 ] }, { "code": 406, "name": "Not Acceptable", "desc": "The server cannot produce anything the request's Accept headers will take.", "kind": "registered", "spec": "[RFC9110, Section 15.5.7]" }, { "code": 407, "name": "Proxy Authentication Required", "desc": "Like 401, but the proxy in between is the one demanding credentials.", "kind": "registered", "spec": "[RFC9110, Section 15.5.8]" }, { "code": 408, "name": "Request Timeout", "desc": "The client took too long to send the request and the server gave up waiting.", "kind": "registered", "spec": "[RFC9110, Section 15.5.9]" }, { "code": 409, "name": "Conflict", "desc": "The request clashes with the current state, such as an edit against a stale version.", "kind": "registered", "spec": "[RFC9110, Section 15.5.10]", "commonCauses": [ "Two writes to the same record raced and the second was based on stale data.", "A uniqueness constraint would be violated, such as an email that already exists.", "A state machine was asked for a transition that is not legal from its current state." ], "howToFix": "Re-read the current state and decide whether to merge or abandon the write. Preventing the race is better than handling it: use conditional requests with ETags, which lets the server answer 412 before anything is written.", "confusedWith": [ 412, 422 ] }, { "code": 410, "name": "Gone", "desc": "Gone on purpose and not coming back. Stronger and rarer than 404.", "kind": "registered", "spec": "[RFC9110, Section 15.5.11]", "commonCauses": [ "Content was intentionally removed and the operator wants that stated.", "A time limited resource, such as an expired export or share link." ], "howToFix": "Nothing to fix on the client. As an operator, prefer 410 over 404 when you know the resource is permanently gone: search engines drop a 410 faster than a 404.", "confusedWith": [ 404 ] }, { "code": 411, "name": "Length Required", "desc": "The server refuses the request without a Content-Length header.", "kind": "registered", "spec": "[RFC9110, Section 15.5.12]" }, { "code": 412, "name": "Precondition Failed", "desc": "A precondition in the request headers, such as If-Match, evaluated to false.", "kind": "registered", "spec": "[RFC9110, Section 15.5.13]" }, { "code": 413, "name": "Content Too Large", "desc": "The request body is larger than the server is willing to process.", "kind": "registered", "spec": "[RFC9110, Section 15.5.14]" }, { "code": 414, "name": "URI Too Long", "desc": "The URI is longer than the server is willing to interpret.", "kind": "registered", "spec": "[RFC9110, Section 15.5.15]" }, { "code": 415, "name": "Unsupported Media Type", "desc": "The body's media type is not one this endpoint accepts.", "kind": "registered", "spec": "[RFC9110, Section 15.5.16]" }, { "code": 416, "name": "Range Not Satisfiable", "desc": "The requested byte range lies outside the size of the resource.", "kind": "registered", "spec": "[RFC9110, Section 15.5.17]" }, { "code": 417, "name": "Expectation Failed", "desc": "The Expect header asked for something the server cannot meet.", "kind": "registered", "spec": "[RFC9110, Section 15.5.18]" }, { "code": 418, "name": "I'm a teapot (unused)", "desc": "Reserved and never to be implemented, because of the 1998 teapot joke.", "kind": "unused", "spec": "[RFC9110, Section 15.5.19]", "commonCauses": [ "A joke endpoint, or a server deliberately signalling that a route is a decoy.", "A framework that implemented the 1998 April Fools specification for fun." ], "howToFix": "Nothing. IANA lists 418 as reserved precisely so no one can assign it a real meaning. Do not build behaviour on it.", "confusedWith": [] }, { "code": 421, "name": "Misdirected Request", "desc": "This connection cannot serve that authority, so open a new one.", "kind": "registered", "spec": "[RFC9110, Section 15.5.20]" }, { "code": 422, "name": "Unprocessable Content", "desc": "The syntax is fine but the content is semantically wrong, such as a failed validation.", "kind": "registered", "spec": "[RFC9110, Section 15.5.21]", "commonCauses": [ "A field failed validation, such as a date in the past where a future date is required.", "The payload parses but references something that does not exist.", "A business rule rejected an otherwise well formed request." ], "howToFix": "Return and read the per field errors: a 422 without a body explaining which field failed is a wasted response. Use 400 only when the request could not be parsed at all.", "confusedWith": [ 400, 409 ] }, { "code": 423, "name": "Locked", "desc": "The resource is locked. WebDAV.", "kind": "registered", "spec": "[RFC4918]" }, { "code": 424, "name": "Failed Dependency", "desc": "The request failed because an earlier request it depended on failed. WebDAV.", "kind": "registered", "spec": "[RFC4918]" }, { "code": 425, "name": "Too Early", "desc": "The server will not risk replaying an early data request.", "kind": "registered", "spec": "[RFC8470]" }, { "code": 426, "name": "Upgrade Required", "desc": "The client must switch protocols, for example from HTTP to TLS.", "kind": "registered", "spec": "[RFC9110, Section 15.5.22]" }, { "code": 428, "name": "Precondition Required", "desc": "The server requires a conditional request, to stop a blind overwrite.", "kind": "registered", "spec": "[RFC6585]" }, { "code": 429, "name": "Too Many Requests", "desc": "You are being rate limited. Slow down and honour Retry-After.", "kind": "registered", "spec": "[RFC6585]", "commonCauses": [ "A client loop firing requests without any backoff.", "A shared API key used by several services at once.", "A burst limit that is much lower than the advertised hourly limit." ], "howToFix": "Honour the Retry-After header if it is present, and back off exponentially with jitter if it is not. Retrying immediately is the one response that reliably makes it worse.", "confusedWith": [ 503 ] }, { "code": 431, "name": "Request Header Fields Too Large", "desc": "The request headers are collectively or individually too large.", "kind": "registered", "spec": "[RFC6585]" }, { "code": 444, "name": "No Response", "desc": "nginx closes the connection without sending any response at all.", "kind": "vendor", "vendor": "nginx, NGX_HTTP_CLOSE in src/http/ngx_http_request.h", "vendorUrl": "https://nginx.org/en/docs/http/ngx_http_core_module.html", "commonCauses": [ "A return 444 rule used to drop malicious or unwanted traffic silently." ], "howToFix": "Nothing arrives at the client, so this shows up as a dropped connection rather than a status code. Check the nginx configuration for an explicit return 444." }, { "code": 451, "name": "Unavailable For Legal Reasons", "desc": "Access is denied for legal reasons, such as a court order.", "kind": "registered", "spec": "[RFC7725]", "commonCauses": [ "A takedown order or court injunction covering the content.", "A geographic block imposed to comply with local law." ], "howToFix": "Nothing technical. The specification asks the server to explain the legal demand in the response body.", "confusedWith": [ 403 ] }, { "code": 499, "name": "Client Closed Request", "desc": "The client hung up before nginx could send a response. Logged, never sent.", "kind": "vendor", "vendor": "nginx, NGX_HTTP_CLIENT_CLOSED_REQUEST in src/http/ngx_http_request.h", "vendorUrl": "https://nginx.org/en/docs/", "commonCauses": [ "A user navigated away or refreshed while the request was still running.", "A client side timeout that is shorter than the server's own processing time.", "A load balancer in front of nginx cancelling the request first." ], "howToFix": "A rise in 499s usually means responses got slower, not that clients got impatient. Compare the 499 rate against your response time percentiles before changing any timeouts.", "confusedWith": [ 408 ] }, { "code": 500, "name": "Internal Server Error", "desc": "The server hit an unexpected condition. This is the catch all failure.", "kind": "registered", "spec": "[RFC9110, Section 15.6.1]", "commonCauses": [ "An unhandled exception in application code.", "A failed database connection or a query that timed out.", "A missing environment variable or configuration value in a fresh deployment." ], "howToFix": "This is the code that tells you least, so go to the server logs and the request ID. If the failure is a dependency rather than your own code, 502, 503, or 504 describe it far better to the caller.", "confusedWith": [ 502, 503 ] }, { "code": 501, "name": "Not Implemented", "desc": "The server does not support the functionality needed to fulfil the request.", "kind": "registered", "spec": "[RFC9110, Section 15.6.2]" }, { "code": 502, "name": "Bad Gateway", "desc": "The server acted as a gateway and got an invalid response from upstream.", "kind": "registered", "spec": "[RFC9110, Section 15.6.3]", "commonCauses": [ "The upstream process crashed or is not listening on the expected port.", "The upstream returned a response the proxy could not parse.", "A protocol mismatch, such as a proxy speaking HTTP to a TLS only backend." ], "howToFix": "Check whether the upstream is running and reachable from the proxy, not from your laptop. A 502 always means the proxy reached a conclusion about the backend, so its logs name the backend.", "confusedWith": [ 503, 504 ] }, { "code": 503, "name": "Service Unavailable", "desc": "The server cannot handle the request right now: overload or maintenance.", "kind": "registered", "spec": "[RFC9110, Section 15.6.4]", "commonCauses": [ "A deliberate maintenance window.", "Autoscaling has not caught up with a traffic spike.", "A health check is failing and the load balancer has no healthy targets." ], "howToFix": "Look at capacity and health checks rather than application code. A well behaved 503 carries Retry-After, which is what lets clients back off instead of hammering.", "confusedWith": [ 500, 504 ] }, { "code": 504, "name": "Gateway Timeout", "desc": "The server acted as a gateway and upstream did not answer in time.", "kind": "registered", "spec": "[RFC9110, Section 15.6.5]", "commonCauses": [ "An upstream request that takes longer than the gateway timeout.", "A slow query or a lock in the database behind the service.", "A chain of services where each hop has its own, shorter, timeout." ], "howToFix": "Compare the timeouts along the whole chain: the smallest one wins, and it is usually not the one you tuned. Then attack the slow work itself, because raising a timeout only moves the failure later.", "confusedWith": [ 502, 408 ] }, { "code": 505, "name": "HTTP Version Not Supported", "desc": "The HTTP version used in the request is not supported.", "kind": "registered", "spec": "[RFC9110, Section 15.6.6]" }, { "code": 506, "name": "Variant Also Negotiates", "desc": "A content negotiation configuration error on the server.", "kind": "registered", "spec": "[RFC2295]" }, { "code": 507, "name": "Insufficient Storage", "desc": "The server has no room to store what the request needs. WebDAV.", "kind": "registered", "spec": "[RFC4918]" }, { "code": 508, "name": "Loop Detected", "desc": "The server detected an infinite loop while processing. WebDAV.", "kind": "registered", "spec": "[RFC5842]" }, { "code": 510, "name": "Not Extended", "desc": "Obsoleted. The request needed extensions the server does not support.", "kind": "obsoleted", "spec": "[RFC2774][Status change of HTTP experiments to Historic]" }, { "code": 511, "name": "Network Authentication Required", "desc": "You must authenticate with the network itself, typically a captive portal.", "kind": "registered", "spec": "[RFC6585]" }, { "code": 520, "name": "Web Server Returns an Unknown Error", "desc": "Cloudflare reached the origin but the answer made no sense to it.", "kind": "vendor", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/", "commonCauses": [ "The origin returned an empty response or an oversized header.", "The origin connection was reset mid response." ], "howToFix": "Reproduce the request straight against the origin, bypassing Cloudflare, and compare the raw response. A 520 means the origin answered, so the origin logs have the request." }, { "code": 521, "name": "Web Server Is Down", "desc": "Cloudflare could not open a connection to the origin at all.", "kind": "vendor", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/", "commonCauses": [ "The origin service is stopped.", "A firewall at the origin is blocking Cloudflare's IP ranges." ], "howToFix": "Check that the origin is listening, and that its firewall allows the Cloudflare address ranges." }, { "code": 522, "name": "Connection Timed Out", "desc": "Cloudflare's TCP connection attempt to the origin never completed.", "kind": "vendor", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/", "commonCauses": [ "The origin is overloaded and not accepting new connections.", "Packets are being dropped between Cloudflare and the origin." ], "howToFix": "Look at connection level metrics at the origin rather than application logs: in a 522 the request never became an HTTP request.", "confusedWith": [ 524 ] }, { "code": 523, "name": "Origin Is Unreachable", "desc": "Cloudflare cannot route to the origin at all.", "kind": "vendor", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/", "commonCauses": [ "A DNS record points at an address that no longer exists.", "A routing or network configuration change at the origin." ], "howToFix": "Verify that the origin DNS records resolve to an address that is actually live." }, { "code": 524, "name": "A Timeout Occurred", "desc": "Cloudflare connected to the origin, but no response arrived in time.", "kind": "vendor", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/", "commonCauses": [ "A long running request that exceeds the proxy timeout.", "A slow database query or an external call inside the request." ], "howToFix": "Move the slow work to a background job and answer immediately with a job identifier. Raising the timeout only delays the same failure.", "confusedWith": [ 504, 522 ] }, { "code": 525, "name": "SSL Handshake Failed", "desc": "The TLS handshake between Cloudflare and the origin did not complete.", "kind": "vendor", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/", "commonCauses": [ "The origin has no certificate for the requested hostname.", "No cipher suite is shared between the two ends." ], "howToFix": "Check the origin certificate and the SSL mode configured in Cloudflare; a mismatch between the two is the usual cause.", "confusedWith": [ 526 ] }, { "code": 526, "name": "Invalid SSL Certificate", "desc": "Cloudflare could not validate the origin's certificate.", "kind": "vendor", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/", "commonCauses": [ "The origin certificate has expired.", "The certificate is self signed while strict validation is switched on." ], "howToFix": "Renew or replace the origin certificate, or switch the SSL mode to one that matches it.", "confusedWith": [ 525 ] }, { "code": 530, "name": "Cloudflare Error 1xxx", "desc": "Always paired with a Cloudflare 1xxx error that carries the real detail.", "kind": "vendor", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/", "commonCauses": [ "Any of the Cloudflare 1xxx conditions, which vary widely." ], "howToFix": "Read the 1xxx code shown with the 530. The 530 alone carries no diagnosis and looking it up on its own is a dead end." } ] }