HTTPfy

HTTP status codes

Every code in the IANA registry (64 codes) and 24 non-standard codes you will meet in nginx logs, Cloudflare error pages and AWS load balancers. Pick a code for causes, fixes and an example response.

Opens the HTTP headers tool with your URL filled in; it shows the status line and headers of every redirect hop.

1xx Informational

Interim responses sent before the final response. The request is still in progress.

100 Continue Interim response: the server has received the request headers and the client may send the body. 101 Switching Protocols The server agrees to switch the connection to the protocol named in the Upgrade header, most often WebSocket. 102 Processing WebDAV interim response telling the client the server is still working on a long request. 103 Early Hints Interim response carrying Link headers so the browser can preload or preconnect before the final response is ready. 104 Upload Resumption Supported temporary Temporary registration: interim response announcing that the server supports resumable uploads for this request.

2xx Successful

The request was received, understood and accepted.

200 OK The request succeeded and the response body contains the result. 201 Created The request succeeded and created a new resource, usually identified by the Location header. 202 Accepted The request was accepted for processing, but processing has not finished. 203 Non-Authoritative Information Success, but a transforming proxy modified the response from the origin. 204 No Content Success with no response body. 205 Reset Content Success; the client should reset the document view (for example clear the form) that sent the request. 206 Partial Content The server is sending only the byte range(s) the client asked for with a Range header. 207 Multi-Status WebDAV: the XML body contains separate status codes for multiple resources. 208 Already Reported WebDAV: members of this binding were already listed earlier in the same multistatus response. 226 IM Used The server applied instance manipulations (delta encoding) to the resource, as requested with A-IM.

3xx Redirection

The client must take further action, usually following the Location header.

300 Multiple Choices The resource has several representations and the client or user should choose one. 301 Moved Permanently The resource has moved permanently to the URL in the Location header. 302 Found The resource is temporarily at the URL in the Location header; keep using the original URL. 303 See Other See another resource with GET: the result of this request is at the URL in Location. 304 Not Modified Not modified: the client's cached copy is still valid, so no body is sent. 305 Use Proxy obsolete Deprecated: the resource must be accessed through the proxy given in Location. 306 (Unused) obsolete Unused: reserved code, previously "Switch Proxy" in a draft; no longer used. 307 Temporary Redirect Temporary redirect that requires the client to keep the same method and body. 308 Permanent Redirect Permanent redirect that requires the client to keep the same method and body.

4xx Client error

The request contains an error or cannot be fulfilled as sent.

400 Bad Request The server cannot process the request because it is malformed or invalid. 401 Unauthorized Authentication is required or the supplied credentials are invalid. 402 Payment Required Reserved for future use; some APIs use it to signal that payment is required or failed. 403 Forbidden The server understood the request but refuses to authorize it. 404 Not Found The server cannot find anything at the requested URL. 405 Method Not Allowed The resource exists but does not support the HTTP method used. 406 Not Acceptable The server cannot produce a response matching the request's Accept headers. 407 Proxy Authentication Required The client must authenticate with a proxy before the request can go through. 408 Request Timeout The server timed out waiting for the client to finish sending the request. 409 Conflict The request conflicts with the current state of the resource. 410 Gone The resource is gone permanently and no forwarding address is known. 411 Length Required The server requires a Content-Length header for this request. 412 Precondition Failed A precondition in the request headers (If-Match, If-Unmodified-Since, If-None-Match) was false. 413 Content Too Large The request body is larger than the server is willing to process. 414 URI Too Long The URL (request target) is longer than the server is willing to interpret. 415 Unsupported Media Type The server does not support the request body's media type or content encoding. 416 Range Not Satisfiable The byte range requested in the Range header cannot be satisfied. 417 Expectation Failed The server cannot meet the requirement in the request's Expect header. 418 (Unused) I'm a teapot Unused / reserved: the "I'm a teapot" joke code from RFC 2324, kept reserved by RFC 9110. 421 Misdirected Request The request was sent to a server that cannot produce a response for that host and scheme. 422 Unprocessable Content The request is well-formed but contains semantic errors, typically failed validation. 423 Locked WebDAV: the resource is locked. 424 Failed Dependency WebDAV: the request failed because a request it depended on failed. 425 Too Early The server will not process a request sent as TLS 1.3 early data (0-RTT) because it could be replayed. 426 Upgrade Required The server refuses the request over the current protocol and requires an upgrade named in the Upgrade header. 428 Precondition Required The server requires the request to be conditional (If-Match etc.) to prevent lost updates. 429 Too Many Requests The client has sent too many requests in a given time (rate limiting). 431 Request Header Fields Too Large The request headers are too large, either one header or all of them together. 451 Unavailable For Legal Reasons The resource is unavailable for legal reasons, such as a court order or government censorship.

Non-standard 4xx codes

Not in the IANA registry, but emitted by widely used software.

419 Page Expired Laravel Laravel: the CSRF token is missing or invalid, usually because the session expired. 444 No Response nginx nginx: close the connection without sending any response. 460 Client Closed Connection (ALB) AWS Application Load Balancer AWS ALB log code: the client closed the connection before the idle timeout elapsed. 463 X-Forwarded-For Too Many IPs (ALB) AWS Application Load Balancer AWS ALB: the request's X-Forwarded-For header contained more than 30 IP addresses. 464 Incompatible Protocol (ALB) AWS Application Load Balancer AWS ALB: the request protocol is incompatible with the target group's protocol version. 494 Request Header Too Large nginx nginx internal: request header or cookie too large; the client receives 400. 495 SSL Certificate Error nginx nginx internal: the client certificate failed verification; the client receives 400. 496 SSL Certificate Required nginx nginx internal: a client certificate was required but none was sent; the client receives 400. 497 HTTP Request Sent to HTTPS Port nginx nginx internal: a plain HTTP request arrived on a TLS port; the client receives 400. 499 Client Closed Request nginx nginx log-only code: the client closed the connection before nginx sent the response.

5xx Server error

The server failed to fulfil a valid request.

500 Internal Server Error The server hit an unexpected condition that stopped it from fulfilling the request. 501 Not Implemented The server does not support the functionality required, typically an unrecognised request method. 502 Bad Gateway A gateway or proxy got an invalid response, or no response, from the upstream server. 503 Service Unavailable The server is temporarily unable to handle the request (overload or maintenance). 504 Gateway Timeout A gateway or proxy did not get a response from the upstream server in time. 505 HTTP Version Not Supported The server does not support the major HTTP version used in the request. 506 Variant Also Negotiates Transparent content negotiation misconfiguration: the chosen variant is itself negotiable. 507 Insufficient Storage WebDAV: the server cannot store the representation needed to complete the request. 508 Loop Detected WebDAV: the server found an infinite loop while processing a Depth: infinity request. 510 Not Extended obsolete Obsolete: the request needs further extensions (RFC 2774 HTTP Extension Framework). 511 Network Authentication Required The client must authenticate to gain network access, typically through a captive portal.

Non-standard 5xx codes

Not in the IANA registry, but emitted by widely used software.

509 Bandwidth Limit Exceeded Apache / cPanel hosting Shared hosting: the site has used up its bandwidth allowance. 520 Web Server Returned an Unknown Error Cloudflare Cloudflare: the origin returned an empty, unknown or unexpected response. 521 Web Server Is Down Cloudflare Cloudflare: the origin refused the connection. 522 Connection Timed Out Cloudflare Cloudflare: the TCP connection to the origin timed out. 523 Origin Is Unreachable Cloudflare Cloudflare: it cannot reach the origin at all (routing or DNS problem). 524 A Timeout Occurred Cloudflare Cloudflare: the origin accepted the connection but did not send an HTTP response within 100 seconds. 525 SSL Handshake Failed Cloudflare Cloudflare: the TLS handshake between Cloudflare and the origin failed. 526 Invalid SSL Certificate Cloudflare Cloudflare: in Full (strict) mode, the origin's certificate could not be validated. 527 Railgun Error (retired) Cloudflare Cloudflare (retired): an error between Cloudflare and the origin's Railgun listener. 529 Site Is Overloaded Various APIs (e.g. Anthropic API, Qualys SSL Labs) Non-standard: the service is overloaded; used by some APIs instead of 503. 530 Origin Error (with 1xxx code) Cloudflare Cloudflare: returned together with a Cloudflare 1xxx error, such as 1016 Origin DNS error or 1033 Tunnel error. 561 Unauthorized (ALB authentication) AWS Application Load Balancer AWS ALB: the identity provider returned an error while the load balancer was authenticating the user. 598 Network Read Timeout Error Some HTTP proxies (informal) Informal: a proxy timed out reading the response from the upstream server. 599 Network Connect Timeout Error Some HTTP proxies and clients (informal) Informal: a connection timed out at the network level, used by some proxies and HTTP client libraries.

How HTTP status codes work

Every HTTP response starts with a three-digit status code. The first digit is the class, and it carries most of the meaning: RFC 9110 requires a client that does not recognise a code to treat it like the x00 code of its class, so an unknown 471 is handled as 400 and an unknown 599 as 500. The reason phrase after the number ("Not Found") is informational only; HTTP/2 and HTTP/3 drop it entirely.

Interim and final responses. 1xx codes are interim: a server may send several (for example 100 Continue or 103 Early Hints) before the one final 2xx-5xx response for the request.

Who generated the code. A response may come from your application, the web server in front of it, a load balancer, a CDN or a corporate proxy. The Server header and the look of the error page usually tell you which layer answered. A 502 or 504 is always produced by a gateway about the server behind it, and Cloudflare's 52x codes describe the connection between Cloudflare and your origin.

Caching. Only these codes are heuristically cacheable, meaning caches may store them without explicit freshness information: 200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414, 501. Everything else is cached only when the response carries Cache-Control or Expires.

Non-standard codes. Codes such as nginx's 444 and 499 or Cloudflare's 520-530 are not registered. Some never reach the client at all and exist only in logs; each page below says what the client actually receives.

Data source

Registered codes, names and defining documents come from the Hypertext Transfer Protocol (HTTP) Status Code Registry (CC0 1.0 (IANA registry data)), retrieved 2026-11-10. Explanations, causes and fixes are written by httpfy.io.