HTTP Status Codes

The server has received the request headers and the client should go ahead and send the body. It answers a request sent with Expect: 100-continue.

The server agrees to switch the connection to the protocol named in the Upgrade header — almost always a WebSocket handshake.

A WebDAV interim response saying the server has accepted a long-running request and is still working on it, so the client shouldn't time out.

Sent before the final response so the browser can start preloading or preconnecting to resources listed in Link headers while the server is still building the page.

A provisional registration for the IETF resumable uploads draft: the server tells the client where an interrupted upload can be resumed.

The request succeeded. For GET the body is the resource; for POST it's the result of the action.

The request succeeded and created a new resource, usually identified by the Location header.

The request was accepted for processing, but the work isn't finished — it may still fail. Common for queued or asynchronous jobs.

Success, but a transforming proxy modified the origin server's 200 response — for example by recompressing images.

The request succeeded and there's deliberately no response body.

Success; the client should reset the document view, such as clearing a form for another entry.

The server is sending only the byte range(s) the client asked for with a Range header — how video seeking and resumable downloads work.

A WebDAV response whose XML body holds a separate status for each of several resources — some may have failed.

Used inside a WebDAV 207 body: this resource was already listed earlier in the response, so it isn't repeated (avoids loops with bindings).

The server applied instance manipulations, such as a delta encoding, and the body is the result rather than the full resource.

The resource has several representations (languages, formats) and the client or user should pick one.

The resource has a new permanent URL in Location. Browsers and search engines update to it, and browsers cache the redirect aggressively.

The resource is temporarily at the URL in Location; keep using the original URL for future requests.

Go fetch a different URL with GET — typically the result page after a form submission (the Post/Redirect/Get pattern).

A conditional request (If-None-Match or If-Modified-Since) matched: the client's cached copy is still current, so no body is sent.

Formerly told the client to repeat the request through the proxy in Location. Deprecated for security reasons; browsers ignore it.

Reserved. It was used in an early HTTP/1.1 draft (as Switch Proxy) and is no longer assigned.

Like 302, but the client must repeat the request with the same method and body at the URL in Location.

Like 301, but the method and body must not change: a POST is re-sent as a POST to the new URL.

The server can't or won't process the request because of something it considers a client error — malformed syntax, invalid framing, or invalid parameters.

The request lacks valid authentication credentials. Despite the name it means unauthenticated; the server must say how to authenticate in WWW-Authenticate.

Reserved for future use by the spec, but used in practice by APIs and SaaS products to signal a billing problem or exhausted plan.

The server understood the request and knows who you are (or doesn't care), but refuses it. Re-authenticating won't help.

The server has nothing at this URL — or won't admit that it does. It says nothing about whether the absence is temporary.

The URL exists but doesn't support this method — for example a POST to a GET-only route. The Allow header must list the methods it does support.

The server can't produce a response matching the request's Accept, Accept-Language, or Accept-Encoding headers.

Like 401, but the client must first authenticate with a proxy between it and the server.

The server gave up waiting for the client to finish sending the request, and is closing the connection. Browsers also see it when an idle keep-alive connection is closed.

The request conflicts with the resource's current state — an edit conflict, a duplicate, or a state transition that isn't allowed.

The resource was deliberately removed and won't be back. Search engines drop 410 URLs faster than 404s.

The server refuses a request body without a Content-Length header.

A condition in the request headers, such as If-Match or If-Unmodified-Since, wasn't met — usually someone else changed the resource first.

The request body is larger than the server is willing to accept.

The URL is longer than the server will process.

The server won't accept the body's format, as given by Content-Type or Content-Encoding.

The byte range in the Range header lies outside the resource — usually past its end.

The server can't meet the Expect request header — in practice, it doesn't support Expect: 100-continue.

The famous "I'm a teapot" from the 1998 April Fools' RFC 2324 (HTCPCP). Because so much software implements the joke, HTTP reserved 418 so it's never assigned to anything real.

Laravel's response when a form's CSRF token is missing or has expired.

The old Twitter API's rate-limit response, replaced by the standard 429. Some other services still use it.

The request reached a server that can't answer for this host — typically an HTTP/2 connection reused for a different domain that shares a certificate.

The body is well-formed and of a supported type, but its content fails validation — a missing required field or an invalid value.

A WebDAV resource is locked and the request didn't include the lock token.

A WebDAV request failed because another action it depended on failed — often inside a 207 batch.

The server won't process a request sent as TLS 1.3 early data (0-RTT) because it could be replayed.

The server refuses the current protocol and names the one to switch to in the Upgrade header.

The server requires conditional requests (If-Match) to prevent lost updates, and this request had none.

Rate limited: the client sent too many requests in a given time.

One header, or all headers together, are too large for the server.

nginx closes the connection without sending anything. The client sees an empty reply or a reset connection; 444 only appears in nginx's logs.

Access is denied for legal reasons — a court order, government censorship, or a takedown. The number nods to Fahrenheit 451.

An AWS Application Load Balancer log entry: the client closed the connection before the load balancer's idle timeout elapsed, so no response was delivered.

An AWS Application Load Balancer received an X-Forwarded-For header with more than 30 IP addresses.

nginx's internal code for a request header or cookie exceeding large_client_header_buffers. Clients normally receive a 400 "Request Header Or Cookie Too Large" page; 494 shows up when used with error_page.

nginx's code for a client certificate that failed verification in mutual TLS. The client receives a 400 page unless error_page maps it.

nginx's code for a request that didn't present the client certificate that mutual TLS requires.

nginx's code for a plain-HTTP request that arrived on a port expecting TLS.

Logged by nginx when the client closed the connection while nginx was still processing the request. Nothing is sent — the client already left.

The server hit an unexpected condition it has no more specific code for — usually an unhandled exception.

The server doesn't support the functionality required — usually a request method it doesn't recognize at all.

A gateway or proxy got an invalid response — or none at all — from the upstream server it forwarded to.

The server is temporarily unable to handle the request — overloaded, or down for maintenance.

A gateway or proxy didn't get a response from the upstream server in time.

The server doesn't support the major HTTP version used in the request.

A server configuration error in transparent content negotiation: the chosen variant is itself set up to negotiate, creating a loop.

The server can't store what's needed to complete the request — typically a full disk or quota on a WebDAV server.

A WebDAV server found an infinite loop while processing a request with Depth: infinity.

Shared hosting's response when an account has used up its bandwidth allowance.

From the experimental HTTP Extension Framework: the request needs further extensions. The framework was moved to Historic status and the code is obsolete.

A captive portal (hotel, airport, café Wi-Fi) is intercepting traffic until you log in to the network.

Cloudflare reached the origin server, but it answered with something empty, unexpected, or unparseable.

The origin refused Cloudflare's connection.

Cloudflare couldn't complete a TCP connection to the origin in time.

Cloudflare can't route to the origin at all — usually a DNS or network problem.

Cloudflare connected to the origin, but the origin didn't send an HTTP response within the timeout (100 seconds by default).

Cloudflare couldn't negotiate TLS with the origin.

With SSL mode Full (strict), Cloudflare couldn't validate the origin's certificate.

Returned together with a Cloudflare 1xxx error (often 1016, origin DNS error) that explains the real problem.