A searchable reference filtered by number, name or meaning - standard codes plus the non-standard ones from nginx, Cloudflare and IIS.
No status code matches. You can search by number (404), name (Not Found) or meaning (not found).
So far so good - send the rest of the request body
An interim response sent when the client includes Expect: 100-continue. The server has read the headers and is willing to receive the body, so a large upload can be checked for auth or size limits before the bytes are sent. The real response follows afterwards.
1xx Informational Not cacheable Must not have a body
Switching to another protocol, typically WebSocket
Accepts the client's Upgrade request and switches the connection to another protocol - in practice almost always the WebSocket handshake. After this response HTTP semantics end and the new protocol takes over the connection.
1xx Informational Not cacheable Must not have a body
Still working - an interim response to stave off timeouts
A WebDAV interim response telling the client that a long-running operation is still in progress. Defined in RFC 4918 but never widely implemented, and now discouraged - 103 Early Hints covers the practical need better.
1xx Informational Not cacheable Must not have a body Deprecated
Sends preload hints before the real response
Sends Link: </style.css>; rel=preload headers while the real response is still being generated, letting the browser start fetching CSS and images early. It shortens time-to-render on slow server-rendered pages, and clients that do not understand it simply ignore it.
1xx Informational Not cacheable Must not have a body
Success - the requested representation is in the body
The most common success response. What the body means depends on the method: for GET it is the requested resource, for POST it is the result of the action. When an API succeeds but has nothing to return, 204 says that more precisely.
In practice: APIs that return {"error":...} inside a 200 body hide failures from CDNs, browsers and monitoring alike. Return real 4xx/5xx codes for failures.
2xx Success Cacheable by default May have a body
A new resource was created - its URL is in Location
Returned when a POST or PUT creates a new resource. The Location header points at the new resource and the body usually carries its representation. Preventing duplicate creation on a retried request still needs an idempotency key of your own.
2xx Success Not cacheable May have a body
Accepted for processing, which has not finished
Used when the request has been queued for asynchronous work. Success is not yet known, so a status URL in the body or Location is the courteous addition. Typical for batch jobs, mail sending and media transcoding.
2xx Success Not cacheable May have a body
Success, but a proxy modified the payload
The origin returned 200 but an intermediary transformed the headers or body. Seen with transforming corporate proxies, though rarely encountered in practice.
2xx Success Cacheable by default May have a body
Success with no body to return
The request succeeded and there is nothing to send back - a completed DELETE, a saved setting, a read flag. It **must not carry a body**; putting JSON here breaks some clients. Browsers stay on the current page instead of navigating.
2xx Success Cacheable by default Must not have a body
Success - the client should reset the form view
Like 204 but also tells the client to clear the form that produced the request. Defined for repeated data entry, but client support is almost nonexistent - resetting in JavaScript is more reliable.
2xx Success Not cacheable Must not have a body
Returning only the requested byte range
Answers a Range request with part of the body - video seeking, resumed downloads and chunked fetches of large files. Content-Range states which bytes were sent, and the response is cached separately from the full 200.
2xx Success Cacheable by default May have a body
Per-resource results for a multi-target operation, as XML
A WebDAV response bundling the outcome of an operation over several resources. The XML body carries a status per target, so an overall 207 can still contain individual 404s or 423s.
2xx Success Not cacheable May have a body
This member was already enumerated earlier in the response
Used inside a 207 body to avoid repeating a resource that has already been listed, which matters when WebDAV bindings create cyclic collections.
2xx Success Not cacheable May have a body
Returning a delta instead of the whole resource
From RFC 3229 delta encoding: the response contains only the difference from the version the client already holds. A bandwidth-saving idea that never saw real deployment.
2xx Success Cacheable by default May have a body
Several representations exist - the client picks one
Offers a list when several representations - different languages or formats - exist for one URL. In practice servers negotiate themselves using Accept-Language, and almost nobody returns 300.
3xx Redirection Cacheable by default May have a body
Permanently moved - use the new URL from now on
Says the URL has permanently changed, with the new location in Location. Search engines pass ranking signals on to the target, so it is the right tool when restructuring a site. Browsers cache it **aggressively** and stop asking the server at all.
In practice: A 301 is effectively irreversible: browsers remember it indefinitely, so undoing it on the server does not bring those visitors back. Use 302 or 307 for anything you might roll back - trials, A/B tests, maintenance redirects.
3xx Redirection Cacheable by default May have a body
Temporarily elsewhere - keep using the original URL
A temporary redirect; search engines keep the original URL indexed. For historical reasons most clients turn a POST into a GET when following it, so use 307 when the method must be preserved.
3xx Redirection Not cacheable May have a body
Done - fetch the result from another URL with GET
Tells the client to GET the result from another URL after a POST. This Post/Redirect/Get pattern stops a page reload from resubmitting the form. The method always becomes GET.
3xx Redirection Not cacheable May have a body
Unchanged - reuse your cached copy
Answers a conditional request (If-None-Match / If-Modified-Since) with "nothing changed". It **carries no body**, so the exchange costs almost no bandwidth. Serving an ETag is enough to make this work.
3xx Redirection Conditional Must not have a body
Fetch through the given proxy (deprecated)
Once instructed clients to fetch via a specified proxy, but it was deprecated because it lets a server redirect traffic through an arbitrary intermediary. Modern browsers ignore it.
3xx Redirection Not cacheable May have a body Deprecated
Reserved - formerly Switch Proxy
Used in an early draft, dropped from the specification and now permanently reserved. It survives only as a gap in the numbering.
3xx Redirection Not cacheable Must not have a body Deprecated
Temporary redirect that preserves method and body
The unambiguous version of 302: a POST stays a POST when followed. Suited to HSTS upgrades and temporary maintenance detours - anything you intend to undo later.
3xx Redirection Not cacheable May have a body
Permanent redirect that preserves method and body
Permanent like 301 but without rewriting the method, which makes it right for moving API endpoints that receive POST or PUT. It is cached just as aggressively, so the same one-way-door caveat applies.
3xx Redirection Cacheable by default May have a body
The request itself is malformed
For broken JSON, missing required parameters or malformed headers - the request cannot be parsed. Failed authentication is 401, insufficient permission is 403, and a well-formed value that business rules reject is better expressed as 422.
4xx Client error Not cacheable May have a body
Not authenticated - valid credentials may succeed
Despite the name it means unauthenticated. The response must include a WWW-Authenticate header naming the accepted scheme. Use it when logging in would help; if the user is logged in but lacks permission, use 403.
4xx Client error Not cacheable May have a body
Payment required - long reserved, now seen in APIs
Reserved for years, but modern APIs do use it for exceeded quotas and unpaid plans. No standard payment flow is defined, so explain the reason and the way out in the body.
4xx Client error Not cacheable May have a body
Refused regardless of who you are
The server understood the request and refuses it; re-authenticating will not change the outcome. Some deployments return 404 instead to hide that the resource exists - a trade-off that also hides it from legitimate users.
4xx Client error Cacheable by default May have a body
Not found, with no statement about the future
Nothing matches the URL. The code deliberately says nothing about whether this is temporary, so crawlers keep coming back to check. Right for typos and pages that do not exist yet.
In practice: "Leave deleted pages as 404 and Google will forget them" is a myth. Google re-crawls a URL it once found for months or years, spending crawl budget that your live pages need. If the removal was deliberate, return 410.
4xx Client error Cacheable by default May have a body
The method is not supported for this URL
The resource exists but does not accept that method. The response must list the usable methods in an Allow header - for example when a POST arrives at a read-only endpoint.
4xx Client error Cacheable by default May have a body
Cannot produce a representation the client accepts
Returned when no available representation satisfies the client's Accept headers. Most servers instead ignore the preference and send their default, so it is rarely seen.
4xx Client error Not cacheable May have a body
The proxy, not the origin, needs credentials
The proxy equivalent of 401, accompanied by a Proxy-Authenticate header. Familiar to anyone working behind an authenticating corporate proxy.
4xx Client error Not cacheable May have a body
The client did not finish sending in time
The connection opened but the request never completed within the server's window - common with large uploads on thin links or idle keep-alive connections. Distinct from 504, which is about waiting on an upstream response.
4xx Client error Not cacheable May have a body
Conflicts with the current state of the resource
Signals a state clash: a duplicate email registration, an edit someone else already made, a window that has closed. Explaining how to resolve it in the body lets the client decide whether to retry.
4xx Client error Not cacheable May have a body
Deliberately removed and not coming back
Unlike 404, this states that the removal is permanent. Search engines drop the URL from the index promptly and stop re-crawling it, which makes 410 the correct cleanup when pages are pruned with no replacement.
In practice: Static sites can do this too: route only the affected prefix through a tiny worker that sets the status. You can keep serving the same body and change only the code, so visitors see no difference while crawlers stop.
4xx Client error Cacheable by default May have a body
Refused because Content-Length is missing
Rejects a request whose body length is unknown. Seen on servers that do not accept chunked transfer or that want to reject oversized uploads before reading them.
4xx Client error Not cacheable May have a body
A conditional request's precondition was false
The condition in If-Match and friends did not hold. It expresses a failed optimistic lock - "update only if the version I read is still current" - and prevents silent lost updates.
4xx Client error Not cacheable May have a body
The request body exceeds the limit
The upload exceeded the size limit - formerly called Payload Too Large. Usually client_max_body_size on nginx or a plan limit on Cloudflare Workers. If the limit is temporary you may add Retry-After.
4xx Client error Not cacheable May have a body
The URL is too long to process
Happens when a GET query string carries too much data; most servers cut off around 8KB. Move the payload into a POST body, or store the state and reference it by a short id.
4xx Client error Cacheable by default May have a body
That Content-Type is not supported
Returned when a JSON-only API receives text/plain, or an unsupported image format is uploaded. Advertising the accepted types via Accept-Post is a helpful touch.
4xx Client error Not cacheable May have a body
The requested range lies outside the resource
The byte range in Range extends past the actual length - typically when a download resumes with stale offsets after the file was replaced.
4xx Client error Not cacheable May have a body
Cannot meet the Expect header's requirement
The server cannot satisfy an Expect header such as 100-continue. Usually surfaces when an intermediary does not understand Expect.
4xx Client error Not cacheable May have a body
I am a teapot and cannot brew coffee
A joke from the 1998 April Fools' RFC 2324 (Hyper Text Coffee Pot Control Protocol). It is not part of HTTP, but became famous enough that many frameworks ship the constant anyway, and the IETF agreed in 2017 to keep the number reserved.
4xx Client error Not cacheable May have a body
The CSRF token expired
Laravel's non-standard code for an expired CSRF token, typically after a form sits open for a long time. In standard terms it is a 400 or 403.
4xx Client error Not cacheable May have a body Non-standard · Laravel
Slow down - you hit the rate limit
The old Twitter v1 API used this for rate limiting, borrowing a line from the film Demolition Man. It has since been replaced by the standard 429.
4xx Client error Not cacheable May have a body Non-standard · Twitter API v1
This connection cannot serve that host
In HTTP/2 several hostnames can share one connection; if the server cannot serve the requested authority even though the certificate matches, it returns 421 and the client may retry on a fresh connection.
4xx Client error Not cacheable May have a body
Well-formed but semantically unacceptable
The JSON parses, but the meaning is wrong: a date in the past, a quantity beyond stock. Where 400 means "unreadable", 422 means "read and rejected" - the usual home for validation errors.
4xx Client error Not cacheable May have a body
The resource is locked
WebDAV returns this when another user holds a lock on the resource. Supplying the lock token allows the operation to proceed.
4xx Client error Not cacheable May have a body
Skipped because a prerequisite action failed
In a multi-part operation, an earlier action failed so this one was never attempted. It usually appears as an individual result inside a 207 body.
4xx Client error Not cacheable May have a body
Refusing early data that could be replayed
Early data sent with TLS 1.3 0-RTT can be replayed by an attacker, so the server refuses requests with side effects and asks the client to send them again on a normal handshake.
4xx Client error Not cacheable May have a body
You must switch protocols to continue
Asks the client to move to a protocol the server requires - a newer HTTP version, or TLS. The needed protocol is named in the Upgrade header.
4xx Client error Not cacheable May have a body
Requests must be conditional
Unconditional updates can silently overwrite someone else's change, so the server insists on If-Match and answers 428 until the client complies.
4xx Client error Not cacheable May have a body
Rate limited - slow down and retry later
The rate limit kicked in. Always include Retry-After; without it clients retry blindly. Used both to protect APIs and to slow down over-eager crawlers.
4xx Client error Not cacheable May have a body
Shopify's own rate-limit code
A Shopify-specific code used alongside 429 to signal too many requests on certain endpoints.
4xx Client error Not cacheable May have a body Non-standard · Shopify
The request headers are too large
Most often caused by bloated cookies - either one oversized header or too much in total. Clearing the offending cookie usually fixes it.
4xx Client error Not cacheable May have a body
The session expired (IIS)
Microsoft IIS returns this when a session has expired and the user must sign in again; the standard equivalent is 401.
4xx Client error Not cacheable May have a body Non-standard · IIS
Connection closed without any response
An nginx-internal code recorded in the log when the server closes a connection without replying, typically to malicious traffic. The client receives nothing.
4xx Client error Not cacheable Must not have a body Non-standard · nginx
Retry with more information (IIS)
A Microsoft extension asking the client to retry after supplying missing information. Rarely seen outside Microsoft's own stacks.
4xx Client error Not cacheable May have a body Non-standard · IIS
Blocked by Windows Parental Controls
A Microsoft-specific code used when Windows Parental Controls blocked the page.
4xx Client error Not cacheable May have a body Non-standard · Microsoft
Blocked for legal reasons
Indicates that access is blocked by censorship, a court order or regional regulation. The number nods to Fahrenheit 451, and Link: rel="blocked-by" can identify who demanded the block.
4xx Client error Cacheable by default May have a body
The client disconnected before the response
An AWS load balancer code recording that the client hung up before the response was sent - often just a user closing the tab, not a fault.
4xx Client error Not cacheable Must not have a body Non-standard · AWS ELB
Header too large (nginx internal)
An nginx-internal equivalent of the standard 431, appearing only in logs.
4xx Client error Not cacheable Must not have a body Non-standard · nginx
The client certificate is invalid
Logged by nginx when client certificate verification fails - specific to mutual TLS setups.
4xx Client error Not cacheable Must not have a body Non-standard · nginx
No client certificate was presented
Logged by nginx when mutual TLS is required but the client offered no certificate.
4xx Client error Not cacheable Must not have a body Non-standard · nginx
Plain HTTP arrived on the HTTPS port
nginx logs this when a plaintext request reaches a port expecting TLS - usually a port or upstream misconfiguration.
4xx Client error Not cacheable Must not have a body Non-standard · nginx
The token is invalid or expired
A code specific to Esri's ArcGIS products; the standard equivalent is 401.
4xx Client error Not cacheable May have a body Non-standard · Esri ArcGIS
The client closed the connection before the reply
A familiar entry in nginx logs. It covers both a user leaving mid-load and a client giving up on a slow upstream - a sudden increase is a hint to look at back-end latency.
4xx Client error Not cacheable Must not have a body Non-standard · nginx
An unexpected server-side error
The catch-all for server-side failures that fit nothing more specific. Keep internals - exception messages, stack traces, database hostnames - out of the visible body and in the logs.
5xx Server error Not cacheable May have a body
The server does not implement that method at all
Where 405 means "not for this URL", 501 means the server cannot handle that method anywhere. It also covers functionality planned but not yet built.
5xx Server error Cacheable by default May have a body
The upstream server returned an invalid response
A reverse proxy or CDN could not get a valid response from the application behind it - the app is down, listening elsewhere, or still starting. The front tier writes the response, but the logs to read are the back tier's.
5xx Server error Not cacheable May have a body
Temporarily unable to handle the request
Temporarily down for maintenance or overloaded. Adding Retry-After tells search engines the outage is temporary so the page is not dropped from the index. Serve maintenance pages as 503, never 200.
In practice: Uptime checks that only look at the home page are not enough: a cached edge copy keeps returning 200 while the database is down. Expose a health endpoint that actually touches the database.
5xx Server error Not cacheable May have a body
The upstream did not answer in time
The front tier gave up waiting for the back tier - heavy queries, a slow third-party API, an exhausted connection pool. 502 means a broken answer arrived; 504 means none did.
5xx Server error Not cacheable May have a body
That HTTP version is not supported
The server does not support the HTTP version in the request line - seen with very old clients or hand-written requests that get the version string wrong.
5xx Server error Not cacheable May have a body
Content negotiation is misconfigured in a loop
In transparent content negotiation, the chosen variant is itself negotiable, creating a loop. It points at a server misconfiguration.
5xx Server error Not cacheable May have a body
Not enough storage to complete the operation
WebDAV returns this when the server lacks the space to finish a write - a full disk or an exceeded quota.
5xx Server error Not cacheable May have a body
An infinite loop was detected while processing
WebDAV bindings created a cycle, so the server aborted rather than loop forever. It is the give-up counterpart to the 208 optimisation.
5xx Server error Not cacheable May have a body
The bandwidth quota was exceeded
A non-standard code from shared-hosting control panels such as cPanel when a site exceeds its transfer quota.
5xx Server error Not cacheable May have a body Non-standard · cPanel
Further extensions are required
From the RFC 2774 extension framework: the request lacks an extension the server needs. The framework itself saw almost no adoption.
5xx Server error Not cacheable May have a body
You must log in to the network first
The code a public Wi-Fi captive portal is supposed to return; it is generated by the network, not the origin. Most portals redirect with 302 instead, which is precisely what breaks HTTPS connections.
5xx Server error Not cacheable May have a body
The origin returned something Cloudflare could not parse
Cloudflare's catch-all for an empty response, malformed headers or a connection reset from the origin - often an origin crash or duplicated headers.
5xx Server error Not cacheable May have a body Non-standard · Cloudflare
The origin refused the connection
The origin is down, or its firewall is rejecting Cloudflare's IP ranges. Check both that the process is alive and that the allowlist is right.
5xx Server error Not cacheable May have a body Non-standard · Cloudflare
The TCP handshake with the origin timed out
The TCP handshake itself never completed - a routing problem, an overloaded origin or a firewall dropping packets. It fails earlier than a 504, which is about waiting for the response.
5xx Server error Not cacheable May have a body Non-standard · Cloudflare
The origin cannot be reached at all
Bad DNS, a changed origin IP or no route at all. Start by checking where the DNS record points.
5xx Server error Not cacheable May have a body Non-standard · Cloudflare
Connected, but the origin took too long to respond
The origin exceeded Cloudflare's response window (100 seconds by default). The durable fix is to make long jobs asynchronous - return 202 and expose progress at another URL.
5xx Server error Not cacheable May have a body Non-standard · Cloudflare
The TLS handshake with the origin failed
The origin's certificate or cipher suite does not satisfy Cloudflare - commonly an expired certificate or a cipher mismatch.
5xx Server error Not cacheable May have a body Non-standard · Cloudflare
The origin's certificate could not be validated
In Full (Strict) mode the origin presented a self-signed or expired certificate. Installing a Cloudflare Origin CA certificate usually resolves it.
5xx Server error Not cacheable May have a body Non-standard · Cloudflare
Shown together with a Cloudflare 1xxx error
530 alone says little - the accompanying Error 1016-style code carries the real cause. Common pairings are a Workers exception (1101) and a failed origin DNS lookup (1016).
5xx Server error Not cacheable May have a body Non-standard · Cloudflare
A proxy timed out while reading
Used by some proxies and absent from the standard; it marks a network read that timed out.
5xx Server error Not cacheable May have a body Non-standard · Proxies
A proxy timed out while connecting
Non-standard like 598, marking a failed connection attempt. Some HTTP client libraries also use it to surface internal errors.
5xx Server error Not cacheable May have a body Non-standard · Proxies