511 Network Authentication Required

The client must authenticate to gain network access, typically through a captive portal.

511 at a glance

Code: 511
Name: Network Authentication Required
Class: 5xx Server error
Status: IANA-registered standard code
Defined in: RFC 6585, Section 6
Cacheable by default: No by default. Caches store it only when the response carries explicit freshness (Cache-Control max-age, s-maxage or Expires).

What 511 means

511 Network Authentication Required (RFC 6585) is meant for intercepting proxies such as hotel or airport Wi-Fi captive portals. Instead of answering requests with a fake page or a redirect that could be mistaken for the real site, the portal returns 511 with a link to its login page.

What typically causes a 511

Captive portals on public Wi-Fi before you accept terms or log in.
Corporate network access control requiring sign-in.

Fix it on the server

Portal operators: only send 511 to unauthenticated clients, include a login link in the body, and never cache it.

Fix it as a client or visitor

Open any http:// page in a browser to reach the portal login; operating systems detect portals by probing URLs like Android's /generate_204 and Apple's captive.apple.com.

Example response

HTTP/1.1 511 Network Authentication Required
Content-Type: text/html
Cache-Control: no-store

<a href="https://login.wifi.example/">Sign in to use the network</a>