511 Network Authentication Required

RFC 6585, section 6, defines 511 for intercepting proxies that control network access. Origin servers should not generate it. The response should link to a page where the user can log in, but should not contain the login form itself, because the browser would show it under the URL you originally asked for, which invites phishing confusion.

The code exists to help software that is not a browser. Before 511, captive portals answered every request with a 302 or a fake 200 login page, so an app calling an API received HTML it could not parse. A 511 tells any client unambiguously that the network, not the server it asked, is in the way. Many portals still use redirects instead, which is why operating systems also probe known URLs to detect captive portals.

If you are visiting the site

• You joined a public or guest Wi-Fi network and have not completed its login, voucher or terms page.
• Your portal session expired after a time limit, so the network is asking again.
• A corporate network that requires device or user authentication before internet access.

If you run the server

• You operate a captive portal or network gateway and the client has not authenticated yet; this is the intended use.
• An origin server returning 511 by mistake for its own login requirement, where 401 is the correct code.

If you are visiting the site

• Open any plain http:// page (for example http://neverssl.com) so the portal can intercept it and show the login page, then accept the terms or enter the voucher.
• Turn off a VPN or custom DNS for a moment: both can prevent the portal page from loading.
• If the portal never appears, forget the Wi-Fi network and join it again.

If you run the server

• In a portal, return 511 with a short HTML body that links to the login page, and send no challenge headers or login form in that response.
• On an origin server, use 401 with WWW-Authenticate for your own authentication instead of 511.

Only a network gateway or captive portal should send 511. A normal web app or API asking for credentials uses 401.

// Captive portal gateway: runs for every request from the guest network
app.use((req, res, next) => {
  if (isAuthorized(req.ip)) return next();
  res
    .status(511)
    .set('Cache-Control', 'no-store')
    .type('html')
    .send(
      '<meta http-equiv="refresh" content="0; url=https://portal.example.net/login">' +
        '<p>You need to <a href="https://portal.example.net/login">log in to this network</a>.</p>'
    );
});

511 vs 401

401 comes from the website you asked and wants credentials for it; 511 comes from the network in between and wants you to log in to the network.

511 vs 407

407 Proxy Authentication Required comes from a proxy the client knowingly uses and carries a Proxy-Authenticate challenge; 511 comes from an intercepting portal the client never configured.

How do I fix a 511 Network Authentication Required error?

Complete the network login. Open a plain http:// site so the captive portal can show its page, accept the terms or sign in, and then retry. Disabling a VPN or custom DNS temporarily often helps the portal appear.

Is a 511 error caused by the website?

No. RFC 6585 says origin servers should not send it; it comes from the network between you and the site, usually a Wi-Fi captive portal. The site itself may be working fine.

Why does my phone show a Wi-Fi login page automatically?

Operating systems request a known probe URL when joining a network. If the answer is not the expected one, because a portal intercepted it, they open a mini browser with the portal page so you can log in.