HTTP status codes cheat sheet
This cheat sheet puts all 62 status codes in the IANA registry, from 100 Continue to 511 Network Authentication Required, plus the 9 nginx and Cloudflare codes you meet in logs, on one A4 or Letter page with a one-line meaning for each.
Fits one page: A4, Letter.
HTTP status codes
Every status code in the IANA registry, plus nginx and Cloudflare
Informational1xx
- 100Continue Interim go-ahead: the headers were accepted, send the request body now.
- 101Switching Protocols The server agreed to the Upgrade request; the connection now uses another protocol.
- 102Processing WebDAV keep-alive: request received, still working, do not time out.
- 103Early Hints Link headers sent ahead of the final response so the browser can preload early.
Success2xx
- 200OK The request worked and the response body carries the result.
- 201Created A new resource was created; Location says where it lives.
- 202Accepted Queued for processing; not done yet and may still fail.
- 203Non-Authoritative Information Success, but a proxy modified the origin server's response.
- 204No Content Success, and there is deliberately no response body.
- 205Reset Content Success; clear the form or view that sent the request.
- 206Partial Content Only the requested byte range of the file, as asked with a Range header.
- 207Multi-Status Several results in one body, each with its own status code.
- 208Already Reported Inside a 207: this collection was already listed earlier in the response.
- 226IM Used The body is a delta or transformation of the resource, not the full copy.
Redirection3xx
- 300Multiple Choices Several versions of the resource exist and the client should pick one.
- 301Moved Permanently Moved for good to the URL in Location; update links and bookmarks.
- 302Found Temporarily at another URL; keep using the original one.
- 303See Other Fetch the result at another URL with GET, typically after a POST.
- 304Not Modified Your cached copy is still valid; reuse it. Sent with no body.
- 305Use Proxy Deprecated. Once meant: repeat the request through the proxy given.
- 307Temporary Redirect Temporarily elsewhere; repeat the same request, same method and body.
- 308Permanent Redirect Moved for good; repeat the request at Location with the same method.
Client errors4xx
- 400Bad Request The server will not process the request because something in it is malformed.
- 401Unauthorized The request has no valid credentials; log in or send a valid token and try again.
- 402Payment Required Reserved by the spec; in practice, a payment or plan limit blocks the request.
- 403Forbidden The server understood the request and refuses it; logging in again will not change that.
- 404Not Found Nothing exists at this URL, or the server will not admit that it does.
- 405Method Not Allowed The URL exists but does not accept this method, for example POST to a read-only page.
- 406Not Acceptable No version of the resource matches the formats or languages the client said it accepts.
- 407Proxy Authentication Required A proxy on the way to the server wants credentials before it forwards the request.
- 408Request Timeout The server stopped waiting because the client took too long to send the full request.
- 409Conflict The request clashes with the current state of the resource, such as a duplicate or a stale edit.
- 410Gone The resource was removed deliberately and will not come back.
- 411Length Required The server refuses a request body without a Content-Length header.
- 412Precondition Failed A conditional header (If-Match, If-Unmodified-Since) evaluated to false.
- 413Content Too Large The request body (usually an upload) is bigger than the server allows.
- 414URI Too Long The URL, usually its query string, is longer than the server will read.
- 415Unsupported Media Type The server does not accept the body format given in Content-Type or Content-Encoding.
- 416Range Not Satisfiable The byte range in the Range header falls outside the file.
- 417Expectation Failed A server on the path cannot honor the request Expect header.
- 418I'm a teapot An April Fools' joke from RFC 2324, now reserved so nobody can reuse it.
- 421Misdirected Request The connection reached a server that will not answer for this hostname.
- 422Unprocessable Content The body is well-formed, but its values break the validation rules.
- 423Locked WebDAV: the file or folder is locked by someone else.
- 424Failed Dependency Skipped because an earlier action in the same request failed.
- 425Too Early Refused because it arrived in TLS 1.3 0-RTT data and could be replayed.
- 426Upgrade Required Switch to the protocol in the Upgrade header, often WebSocket, and try again.
- 428Precondition Required Updates must be conditional: send If-Match with the ETag you last read.
- 429Too Many Requests Rate limited: too many requests in a time window. Wait, then retry.
- 431Request Header Fields Too Large Request headers too big, usually because of too many or oversized cookies.
- 451Unavailable For Legal Reasons Blocked because of a legal demand, like a court order or takedown notice.
Server errors5xx
- 500Internal Server Error Something broke inside the server while handling the request.
- 501Not Implemented The server does not support this method or feature for any resource.
- 502Bad Gateway A proxy or gateway got an invalid response from the server behind it.
- 503Service Unavailable The server is temporarily overloaded or down for maintenance.
- 504Gateway Timeout A proxy gave up waiting for the server behind it to answer.
- 505HTTP Version Not Supported The server refuses the major HTTP version the request used.
- 506Variant Also Negotiates A content negotiation misconfiguration: the chosen variant negotiates too.
- 507Insufficient Storage The server has no room to store what the request needs.
- 508Loop Detected WebDAV hit an infinite loop; on shared hosting, the account hit its resource limit.
- 510Not Extended Obsolete: the request lacked an extension the server required (RFC 2774).
- 511Network Authentication Required You must log in to the network (a captive portal) before browsing.
Unofficial codes (nginx, Cloudflare)4xx/5xx
- 444No Response nginx closed the connection without sending anything back.
- 499Client Closed Request The client hung up before nginx could send the response.
- 520Web Server Returns an Unknown Error Cloudflare got an empty, malformed or unexpected response from the origin.
- 521Web Server Is Down The origin refused Cloudflare’s connection: server stopped or IPs blocked.
- 522Connection Timed Out Cloudflare’s TCP connection to the origin got no answer in time.
- 523Origin Is Unreachable Cloudflare has no network route to the origin’s IP address.
- 524A Timeout Occurred The origin accepted the request but did not answer within Cloudflare’s timeout.
- 525SSL Handshake Failed The TLS handshake between Cloudflare and the origin failed.
- 526Invalid SSL Certificate Full (strict) mode could not validate the origin’s certificate.
What is on the sheet
Codes are grouped by class, 1xx to 5xx, because the first digit already tells you whose move it is: a 4xx means the request has to change, a 5xx means the server or something behind it failed. The vendor codes sit in their own group at the end so 499 or 522 are never mistaken for the standard.
Every line is the same summary used on the full reference page for that code, which cites the RFC that defines it. On screen, each code links to that page with causes, fixes and examples for Express, Next.js, Go, FastAPI and nginx.
How to print it on one page
Pick the paper above the sheet and press Print / Save as PDF. The page measures the sheet at that paper width and scales it to fill one page, never below 7pt, then hides the site header, footer, ads and buttons. It always prints black on white, whatever theme you are reading in.
In the print dialog keep Scale on Default (100%) and Margins on Default. To get a PDF, choose Save as PDF as the destination. Safari ignores the paper size a page asks for, so select the same paper in its dialog.
Embed or link to this cheat sheet
Linking to this page from your docs, wiki or README is the best way to share it: readers always get the current version and the print button. Copy one of these:
<a href="https://www.arielton.com/cheatsheets/http-status-codes">HTTP status codes cheat sheet (printable)</a> by <a href="https://www.arielton.com/">Arielton Oberek</a>[HTTP status codes cheat sheet (printable)](https://www.arielton.com/cheatsheets/http-status-codes) by [Arielton Oberek](https://www.arielton.com/)If your team wants the same treatment for an internal API, a CLI or a style guide, write to contact@arielton.com.
Frequently asked questions
- Which HTTP status codes are worth memorizing first?
- 200, 201 and 204 for success; 301 and 308 for permanent redirects, 302 and 307 for temporary ones, and 304 for cache hits; 400, 401, 403, 404, 409, 422 and 429 for client errors; 500, 502, 503 and 504 for server errors. They cover almost every response a typical site or API sends.
- What is the difference between 401 and 403?
- 401 Unauthorized means the request carries no valid credentials, so logging in or sending a valid token can fix it. 403 Forbidden means the server knows who you are and still refuses; logging in again with the same account will not help.
- Why are 499 and 520 to 526 on the sheet if they are not official?
- Because they show up in real logs. nginx records 499 when the client disconnects before the response is ready, and Cloudflare returns 520 to 526 when it cannot get a usable answer from your origin server. They are printed in a separate group so nobody mistakes them for standard codes.
- Where do the meanings on the sheet come from?
- From RFC 9110 (HTTP Semantics) and the other RFCs listed in the IANA HTTP Status Code Registry, condensed to one line each. The full page for every code quotes the section that defines it.
Last reviewed by Arielton Oberek.