Reference, from RFC 9110 and the IANA registry
HTTP status codes
An HTTP status code is the three-digit number a server puts at the start of every response to say how the request went. The first digit is the class: 1xx interim, 2xx success, 3xx redirect, 4xx the request was wrong, 5xx the server failed.
Most searched errors
The codes people look up most, usually because a page or an API call just failed with one of them.
How to read a status code
Read the first digit first. RFC 9110, section 15, defines five classes, and a client that does not recognize a specific code must treat it like the x00 code of its class: an unknown 437 is handled as 400, an unknown 599 as 500. That is why the class matters more than the exact number when you are deciding what to do next.
The class also tells you whose move it is. A 4xx puts the fix on the side that sent the request: a different URL, valid credentials, a smaller body, a slower pace. A 5xx puts it on the server or something behind it, like an application that crashed or an upstream that timed out, and the same request may work a minute later.
Some numbers you will see in logs are not in the IANA registry at all. nginx records 499 when the client hangs up before the response is ready and uses 444 to close a connection without replying. Cloudflare returns 520 to 526 when it cannot get a usable answer from your origin server. They are listed separately below so you know when you are reading a vendor convention and when you are reading the standard.
The authoritative list is the IANA HTTP Status Code Registry. Every registered code people meet in practice has its own page here; 104 (a temporary registration for resumable uploads) and 306 (reserved, unused since HTTP/1.1) are left out.
1xx Informational
Interim responses sent before the final one. The request is still in progress; browsers mostly handle them without showing you anything.
| Status | Meaning |
|---|---|
| 100 Continue | Interim go-ahead: the headers were accepted, send the request body now. |
| 101 Switching Protocols | The server agreed to the Upgrade request; the connection now uses another protocol. |
| 102 Processing | WebDAV keep-alive: request received, still working, do not time out. |
| 103 Early Hints | Link headers sent ahead of the final response so the browser can preload early. |
2xx Success
The server received, understood and accepted the request. The specific code tells you what happened: content returned, resource created, work queued, nothing to send back.
| Status | Meaning |
|---|---|
| 200 OK | The request worked and the response body carries the result. |
| 201 Created | A new resource was created; Location says where it lives. |
| 202 Accepted | Queued for processing; not done yet and may still fail. |
| 203 Non-Authoritative Information | Success, but a proxy modified the origin server's response. |
| 204 No Content | Success, and there is deliberately no response body. |
| 205 Reset Content | Success; clear the form or view that sent the request. |
| 206 Partial Content | Only the requested byte range of the file, as asked with a Range header. |
| 207 Multi-Status | Several results in one body, each with its own status code. |
| 208 Already Reported | Inside a 207: this collection was already listed earlier in the response. |
| 226 IM Used | The body is a delta or transformation of the resource, not the full copy. |
3xx Redirection
The client has to take another step, usually following the Location header to a different URL, or reusing the copy it already has in cache (304).
| Status | Meaning |
|---|---|
| 300 Multiple Choices | Several versions of the resource exist and the client should pick one. |
| 301 Moved Permanently | Moved for good to the URL in Location; update links and bookmarks. |
| 302 Found | Temporarily at another URL; keep using the original one. |
| 303 See Other | Fetch the result at another URL with GET, typically after a POST. |
| 304 Not Modified | Your cached copy is still valid; reuse it. Sent with no body. |
| 305 Use Proxy | Deprecated. Once meant: repeat the request through the proxy given. |
| 307 Temporary Redirect | Temporarily elsewhere; repeat the same request, same method and body. |
| 308 Permanent Redirect | Moved for good; repeat the request at Location with the same method. |
4xx Client errors
The request is the problem: wrong URL, missing or rejected credentials, bad input, too many requests. Sending the same request again gives the same answer.
| Status | Meaning |
|---|---|
| 400 Bad Request | The server will not process the request because something in it is malformed. |
| 401 Unauthorized | The request has no valid credentials; log in or send a valid token and try again. |
| 402 Payment Required | Reserved by the spec; in practice, a payment or plan limit blocks the request. |
| 403 Forbidden | The server understood the request and refuses it; logging in again will not change that. |
| 404 Not Found | Nothing exists at this URL, or the server will not admit that it does. |
| 405 Method Not Allowed | The URL exists but does not accept this method, for example POST to a read-only page. |
| 406 Not Acceptable | No version of the resource matches the formats or languages the client said it accepts. |
| 407 Proxy Authentication Required | A proxy on the way to the server wants credentials before it forwards the request. |
| 408 Request Timeout | The server stopped waiting because the client took too long to send the full request. |
| 409 Conflict | The request clashes with the current state of the resource, such as a duplicate or a stale edit. |
| 410 Gone | The resource was removed deliberately and will not come back. |
| 411 Length Required | The server refuses a request body without a Content-Length header. |
| 412 Precondition Failed | A conditional header (If-Match, If-Unmodified-Since) evaluated to false. |
| 413 Content Too Large | The request body (usually an upload) is bigger than the server allows. |
| 414 URI Too Long | The URL, usually its query string, is longer than the server will read. |
| 415 Unsupported Media Type | The server does not accept the body format given in Content-Type or Content-Encoding. |
| 416 Range Not Satisfiable | The byte range in the Range header falls outside the file. |
| 417 Expectation Failed | A server on the path cannot honor the request Expect header. |
| 418 I'm a teapot | An April Fools' joke from RFC 2324, now reserved so nobody can reuse it. |
| 421 Misdirected Request | The connection reached a server that will not answer for this hostname. |
| 422 Unprocessable Content | The body is well-formed, but its values break the validation rules. |
| 423 Locked | WebDAV: the file or folder is locked by someone else. |
| 424 Failed Dependency | Skipped because an earlier action in the same request failed. |
| 425 Too Early | Refused because it arrived in TLS 1.3 0-RTT data and could be replayed. |
| 426 Upgrade Required | Switch to the protocol in the Upgrade header, often WebSocket, and try again. |
| 428 Precondition Required | Updates must be conditional: send If-Match with the ETag you last read. |
| 429 Too Many Requests | Rate limited: too many requests in a time window. Wait, then retry. |
| 431 Request Header Fields Too Large | Request headers too big, usually because of too many or oversized cookies. |
| 451 Unavailable For Legal Reasons | Blocked because of a legal demand, like a court order or takedown notice. |
5xx Server errors
The request may be fine but the server, or something behind it, failed. These are often temporary, and idempotent requests can be retried with backoff.
| Status | Meaning |
|---|---|
| 500 Internal Server Error | Something broke inside the server while handling the request. |
| 501 Not Implemented | The server does not support this method or feature for any resource. |
| 502 Bad Gateway | A proxy or gateway got an invalid response from the server behind it. |
| 503 Service Unavailable | The server is temporarily overloaded or down for maintenance. |
| 504 Gateway Timeout | A proxy gave up waiting for the server behind it to answer. |
| 505 HTTP Version Not Supported | The server refuses the major HTTP version the request used. |
| 506 Variant Also Negotiates | A content negotiation misconfiguration: the chosen variant negotiates too. |
| 507 Insufficient Storage | The server has no room to store what the request needs. |
| 508 Loop Detected | WebDAV hit an infinite loop; on shared hosting, the account hit its resource limit. |
| 510 Not Extended | Obsolete: the request lacked an extension the server required (RFC 2774). |
| 511 Network Authentication Required | You must log in to the network (a captive portal) before browsing. |
4xx/5xx Unofficial codes (nginx, Cloudflare)
Not in the IANA registry, but common in logs and error pages. nginx uses 444 and 499 internally; Cloudflare uses 520 to 526 to say which side of its proxy failed.
| Status | Meaning |
|---|---|
| 444 No Response | nginx closed the connection without sending anything back. |
| 499 Client Closed Request | The client hung up before nginx could send the response. |
| 520 Web Server Returns an Unknown Error | Cloudflare got an empty, malformed or unexpected response from the origin. |
| 521 Web Server Is Down | The origin refused Cloudflare’s connection: server stopped or IPs blocked. |
| 522 Connection Timed Out | Cloudflare’s TCP connection to the origin got no answer in time. |
| 523 Origin Is Unreachable | Cloudflare has no network route to the origin’s IP address. |
| 524 A Timeout Occurred | The origin accepted the request but did not answer within Cloudflare’s timeout. |
| 525 SSL Handshake Failed | The TLS handshake between Cloudflare and the origin failed. |
| 526 Invalid SSL Certificate | Full (strict) mode could not validate the origin’s certificate. |
Frequently asked questions
- What are the five classes of HTTP status codes?
- 1xx informational (interim responses such as 100 Continue and 103 Early Hints), 2xx success (200 OK, 201 Created, 204 No Content), 3xx redirection (301, 302, 304, 307, 308), 4xx client errors (400, 401, 403, 404, 429) and 5xx server errors (500, 502, 503, 504).
- Where are HTTP status codes officially defined?
- The core codes are defined in RFC 9110, HTTP Semantics (2022), section 15. Others come from separate RFCs, such as RFC 6585 for 428, 429, 431 and 511, and RFC 7725 for 451. IANA keeps the authoritative list in the HTTP Status Code Registry.
- What is the difference between a 4xx and a 5xx error?
- A 4xx means the server thinks the request is wrong and repeating it unchanged will fail again. A 5xx means the server or an upstream failed to handle a request that may be perfectly valid, so retrying later can succeed.
- How do I see the status code of a page?
- Open the browser developer tools, go to the Network tab and reload: the Status column shows the code for every request. From a terminal, curl -I https://example.com prints the status line and headers without the body.
- Can a server invent its own status codes?
- Technically any three-digit number from 100 to 599 goes through, and clients fall back to the class meaning. In practice custom codes cause trouble with proxies, libraries and monitoring. Use a standard code and put the detail in the response body, for example with RFC 9457 problem details.
Last reviewed by Arielton Oberek.