elefcode

HTTP Status Codes

All 70 status codes you are likely to meet — what each means, and for the common errors, what usually causes them and how to fix it.

1xx · Informational

The request was received and the process is continuing.

100

Continue

MDN ↗

The client should continue with its request, or ignore the response if the request is already finished.

101

Switching Protocols

MDN ↗

The server is switching protocols as requested by the client, such as upgrading to WebSocket.

102

Processing

MDN ↗

WebDAV: the server has accepted the request but has not finished it yet. Deprecated in favour of 103.

103

Early Hints

MDN ↗

Used to preload resources while the server prepares the final response.

2xx · Success

The request was successfully received, understood, and accepted.

200

OK

MDN ↗

The request succeeded. The meaning depends on the method: GET returns the resource, POST returns the result of the action.

201

Created

MDN ↗

The request succeeded and a new resource was created, typically after a POST or PUT. The Location header usually points to it.

202

Accepted

MDN ↗

The request has been accepted for processing, but the processing is not complete.

203

Non-Authoritative Information

MDN ↗

The response was modified by a proxy, so it may differ from what the origin server sent.

204

No Content

MDN ↗

The request succeeded but there is no content to send in the response body.

205

Reset Content

MDN ↗

The request succeeded and the client should reset the document view, such as clearing a form.

206

Partial Content

MDN ↗

The server is delivering only part of the resource, in response to a Range header.

207

Multi-Status

MDN ↗

WebDAV: the body contains separate status codes for several operations.

208

Already Reported

MDN ↗

WebDAV: members of a binding were already listed earlier in the same response.

226

IM Used

MDN ↗

The server returned a delta — the result of instance manipulations applied to the resource.

3xx · Redirection

Further action is needed to complete the request.

300

Multiple Choices

MDN ↗

There are several possible responses and the client should choose one. Rarely used in practice.

301

Moved Permanently

MDN ↗

The resource has permanently moved to a new URL. Search engines update their links.

302

Found

MDN ↗

The resource is temporarily at a different URL. The original URL should still be used in future requests.

303

See Other

MDN ↗

The response can be found at another URL using GET, commonly used after a POST.

304

Not Modified

MDN ↗

The cached version of the resource is still valid, so no body is sent. Saves bandwidth.

307

Temporary Redirect

MDN ↗

Like 302, but the request method must not change when following the redirect.

308

Permanent Redirect

MDN ↗

Like 301, but the request method must not change when following the redirect.

4xx · Client Error

The request contains bad syntax or cannot be fulfilled.

400

Bad Request

MDN ↗

The server cannot process the request due to a client error, such as malformed syntax or invalid data.

Common causes & fixes

Check that the body is valid JSON and matches what the API expects — missing required fields, a wrong Content-Type and a malformed query string are the usual suspects. The response body normally says which part was rejected.

401

Unauthorized

MDN ↗

Authentication is required and has failed or not been provided. Despite the name, it means "unauthenticated".

Common causes & fixes

Send credentials, usually in an Authorization header. If you already do, the token may have expired or belong to a different environment. The WWW-Authenticate response header names the scheme the server expects.

402

Payment Required

MDN ↗

Reserved for future use. Some APIs return it when a plan limit or payment is required.

403

Forbidden

MDN ↗

The client is authenticated but does not have permission to access the resource.

Common causes & fixes

Logging in again will not help — the server knows who you are and is refusing. Check the account’s role or permissions and IP allow-lists. For static files, check file permissions and that a directory has an index file. CDN bot protection and firewall rules also answer with 403.

404

Not Found

MDN ↗

The server cannot find the requested resource. The most recognizable status code on the web.

Common causes & fixes

Check the URL for typos, a trailing slash and letter case — paths are case-sensitive on most servers. For an API, confirm the route exists for this method and that the ID refers to something real.

405

Method Not Allowed

MDN ↗

The HTTP method used is not supported for this resource.

Common causes & fixes

The route exists but not for this method — a POST to a GET-only endpoint, for example. The Allow response header lists the methods it accepts. An unhandled CORS preflight (OPTIONS) request can also produce this.

406

Not Acceptable

MDN ↗

The server cannot produce a response in any format the Accept headers ask for.

407

Proxy Authentication Required

MDN ↗

Like 401, but the client must authenticate with a proxy first.

408

Request Timeout

MDN ↗

The server timed out waiting for the request.

Common causes & fixes

The client was too slow to send the request — often a slow network, or a reused keep-alive connection the server had already closed. Retrying usually works.

409

Conflict

MDN ↗

The request conflicts with the current state of the resource, such as an edit conflict.

Common causes & fixes

Re-fetch the latest version and apply your change to that. For create requests, the value usually already exists — a unique field such as an email or username is taken.

410

Gone

MDN ↗

The resource is permanently gone with no forwarding address.

411

Length Required

MDN ↗

The server requires a Content-Length header and the request did not include one.

412

Precondition Failed

MDN ↗

A condition in the request headers, such as If-Match, was not met — often an optimistic-locking check.

413

Content Too Large

MDN ↗

The request body is larger than the server is willing to accept. Formerly "Payload Too Large".

Common causes & fixes

Raise the server’s limit — client_max_body_size in nginx, the limit option of the body parser in Express — or upload in smaller chunks.

414

URI Too Long

MDN ↗

The URL is longer than the server will interpret — often a GET that should have been a POST.

415

Unsupported Media Type

MDN ↗

The server does not support the format of the request body.

Common causes & fixes

Usually a JSON body sent without Content-Type: application/json, or form data sent to an endpoint that expects JSON.

416

Range Not Satisfiable

MDN ↗

The Range header asks for a part of the resource that does not exist.

417

Expectation Failed

MDN ↗

The server cannot meet the requirement in the Expect header.

418

I'm a teapot

MDN ↗

An April Fools’ joke from 1998 — the server refuses to brew coffee because it is a teapot.

421

Misdirected Request

MDN ↗

The request reached a server that cannot respond for this host — common with reused HTTP/2 connections.

422

Unprocessable Content

MDN ↗

The request was well-formed but contains semantic errors, common in API validation.

Common causes & fixes

The request parsed fine but failed validation — an email without an @, a date in the past. The response body normally lists the invalid fields.

423

Locked

MDN ↗

WebDAV: the resource is locked.

424

Failed Dependency

MDN ↗

WebDAV: the request failed because another request it depended on failed.

425

Too Early

MDN ↗

The server will not process a request that might be replayed, such as TLS early data.

426

Upgrade Required

MDN ↗

The client must switch to a different protocol, named in the Upgrade header.

428

Precondition Required

MDN ↗

The server requires the request to be conditional, to prevent lost updates.

429

Too Many Requests

MDN ↗

The client has sent too many requests in a given time — rate limiting.

Common causes & fixes

Wait for the time in the Retry-After header if there is one, retry with exponential backoff, and cache or batch requests so you make fewer of them.

431

Request Header Fields Too Large

MDN ↗

The headers, or a single header, are too large for the server.

Common causes & fixes

Almost always accumulated cookies. Clear the site’s cookies, or raise the server’s header size limit.

451

Unavailable For Legal Reasons

MDN ↗

The resource cannot be served for legal reasons, such as a court order. Named after Fahrenheit 451.

5xx · Server Error

The server failed to fulfill a valid request.

500

Internal Server Error

MDN ↗

A generic error meaning the server encountered an unexpected condition. The catch-all server error.

Common causes & fixes

Something threw an unhandled error on the server. The cause is in the server’s logs, not in the response — look for the stack trace at the time of the request.

501

Not Implemented

MDN ↗

The server does not support the functionality required to fulfill the request.

502

Bad Gateway

MDN ↗

A server acting as a gateway received an invalid response from the upstream server.

Common causes & fixes

The proxy or load balancer could not get a valid answer from the app behind it — the app crashed, is not listening on the expected port, or returned something malformed. Check that the upstream process is running and reachable.

503

Service Unavailable

MDN ↗

The server is not ready — often due to maintenance or overload. Usually temporary.

Common causes & fixes

Usually temporary. Check the Retry-After header, health checks, and whether there are enough instances to handle the load.

504

Gateway Timeout

MDN ↗

A gateway server did not get a timely response from the upstream server.

Common causes & fixes

The upstream took too long. Find the slow part — a database query or an external API — or raise the proxy’s timeout (proxy_read_timeout in nginx, the idle timeout on a load balancer).

505

HTTP Version Not Supported

MDN ↗

The server does not support the HTTP version used in the request.

506

Variant Also Negotiates

MDN ↗

A server configuration error in transparent content negotiation.

507

Insufficient Storage

MDN ↗

The server cannot store the representation needed to complete the request.

508

Loop Detected

MDN ↗

WebDAV: the server found an infinite loop while processing the request.

510

Not Extended

MDN ↗

Further extensions to the request are required for the server to fulfil it.

511

Network Authentication Required

MDN ↗

The client must authenticate to gain network access — typically a captive portal on public Wi-Fi.

Other · Non-standard (Cloudflare, nginx)

Not part of the HTTP standard, but returned by widely used servers and CDNs — and searched for often.

444

No Response (nginx)

nginx closed the connection without sending anything.

Common causes & fixes

Deliberate: the server is configured to drop requests like this one, typically to discard unwanted traffic.

499

Client Closed Request (nginx)

nginx logged that the client closed the connection before the response was sent.

Common causes & fixes

Seen in server logs rather than by the client. Usually the client timed out waiting for a slow response — speed up that endpoint or raise the client’s timeout.

520

Web Server Returned an Unknown Error (Cloudflare)

Cloudflare received an empty, unknown or unexpected response from the origin.

Common causes & fixes

Check the origin server’s error logs. A crashed application and response headers that are too large are common causes.

521

Web Server Is Down (Cloudflare)

The origin refused the connection from Cloudflare.

Common causes & fixes

The web server is not running, or a firewall is blocking Cloudflare’s IP ranges.

522

Connection Timed Out (Cloudflare)

Cloudflare could not complete a TCP connection to the origin in time.

Common causes & fixes

The origin is overloaded, or a firewall is silently dropping Cloudflare’s IPs instead of refusing them.

523

Origin Is Unreachable (Cloudflare)

Cloudflare cannot reach the origin server at all.

Common causes & fixes

Usually a DNS record pointing at the wrong IP — an old server, or a private address.

524

A Timeout Occurred (Cloudflare)

Cloudflare connected to the origin, but it did not respond within 100 seconds.

Common causes & fixes

Move long-running work to a background job and return immediately, or stream the response.

525

SSL Handshake Failed (Cloudflare)

The SSL handshake between Cloudflare and the origin failed.

Common causes & fixes

The origin is not serving HTTPS on port 443, or its TLS settings are incompatible with Cloudflare.

526

Invalid SSL Certificate (Cloudflare)

Cloudflare could not validate the origin’s certificate.

Common causes & fixes

With SSL mode set to Full (strict), the origin needs a valid certificate — not expired, not self-signed, and matching the hostname.

Codes that are easy to mix up

401 means the server does not know who you are — log in or send a token. 403 means it knows, and the answer is no; logging in again will not help.

301 and 308 are permanent, so search engines move ranking to the new URL; 302 and 307 are temporary. 307 and 308 guarantee the method and body are kept, so a POST stays a POST — 301 and 302 let clients switch to GET.

400 when the request cannot be understood at all, such as broken JSON. 422 when it parses fine but the values are invalid.

502: the upstream answered with something broken. 503: the server is turning work away for now. 504: the upstream did not answer in time.

404 says nothing is here and it might come back. 410 says it existed and is gone for good — search engines drop 410s faster.

Use 204 for success with nothing to return, such as after a DELETE. Clients should not expect a body.

Advertisement

Guide

About the HTTP Status Code Reference

Every HTTP response carries a three-digit status code that tells the client what happened. The first digit sets the category — 2xx means success, 3xx a redirect, 4xx a client mistake, and 5xx a server failure. Knowing them makes debugging APIs and websites far faster: the code usually points straight at whether the problem is your request or the server.

This reference lists the codes you'll actually encounter, with plain-language explanations. Search by number or name, or filter by category.

The five classes at a glance

  • 1xx Informational — the request was received and processing continues.
  • 2xx Success — the request was received, understood, and accepted.
  • 3xx Redirection — further action is needed, usually following a new URL.
  • 4xx Client Error — the request was wrong (bad data, missing auth, not found).
  • 5xx Server Error — the request was valid but the server failed to handle it.

Codes people mix up

401 vs 403: 401 means you're not authenticated (log in), while 403 means you're authenticated but not allowed. 301 vs 302: 301 is a permanent move (search engines update their links), 302 is temporary (keep using the original URL). 502 vs 504: 502 means a proxy got a bad response upstream, 504 means the upstream didn't respond in time.

How to use it

  1. 1Search for a code or name, like "404" or "forbidden".
  2. 2Or filter by class (2xx, 4xx, 5xx) to browse a category.
  3. 3Read the plain-language description to understand the cause.
  4. 4Use it to decide whether the fix is on the client or the server.

Frequently asked questions

What is the difference between 401 and 403?

401 Unauthorized means you are not authenticated — you need to log in or provide valid credentials. 403 Forbidden means you are authenticated but lack permission for that resource.

When should I use 301 vs 302?

Use 301 Moved Permanently when a URL has changed for good, so search engines update their index. Use 302 Found (or 307) for a temporary redirect where the original URL should still be used later.

What does a 500 error mean?

500 Internal Server Error is a generic message that the server hit an unexpected condition. The real cause is in the server logs, not the status code itself.

What status code should a successful API POST return?

Commonly 201 Created when a new resource is made, or 200 OK if it returns a result, or 204 No Content if there is nothing to return.

What is 429 Too Many Requests?

It means you have hit a rate limit. Slow down and check for a Retry-After header indicating when you can try again.

Learn more

Related tools