Social
Returns HTTP 999, an invented status code outside the standard range, which breaks HTTP clients that assume codes stop at 599.
LinkedIn's 999 Request Denied is the best known non-standard status code on the web. It is not in the IANA registry, it is not defined by any RFC, and it exists purely as LinkedIn's way of refusing traffic it does not want. There is no 9xx class in HTTP at all.
It causes a particular kind of failure that other blocks do not. Some HTTP client libraries validate status codes against the 100 to 599 range and raise a parsing error rather than returning a response, so a caller can see a range error or an exception instead of a refusal. That sends people looking for a bug in their own code.
The distribution is uneven and worth knowing. The LinkedIn homepage answers ordinary requests with a 200, while a profile URL returns 999 to the same client. The block is applied to the content that matters rather than to the front door.
What is in front of it
- Cloudflare: Serves challenges and blocks on 403, rate limits on 429, and puts its own four-digit error code in the body rather than on the status line.
- Cloudflare at the edge, setting __cf_bm and returning cf-ray on both allowed and denied responses.
- LinkedIn's own access control produces the 999 behind that edge, so the status code is LinkedIn's rather than Cloudflare's.
Status codes
999 Request Denied
Blocked. Observed behaviour.
LinkedIn refused the request. A non-standard code chosen so that it cannot be confused with anything else.
What triggers it
- Requesting member content without an authenticated session.
- Data centre address ranges, which are refused broadly.
- Automated access patterns of essentially any volume.
How to confirm it
- The 999 status itself, which nothing else in normal use returns.
- Cloudflare headers such as cf-ray on the same response.
What to do about it
- Check whether your HTTP client can even represent the code. If you are seeing a range error rather than a response, that is the cause, and it is a client limitation rather than a server fault.
- Treat it as permanent for the request as constructed. It does not clear with time.
- LinkedIn's terms restrict automated collection, and the company enforces that position actively. Its official APIs and partner programmes are the supported route for data access.
HTTP/2 999 server: cloudflare cf-ray: a327118c98382ade-IAD
Notes
- The homepage and member pages behave differently. Testing against the homepage will tell you nothing useful about access to profiles.
- 999 is genuinely outside the HTTP specification, so any tooling that treats status codes as a constrained enum needs a special case. It has no entry in the HTTP status code glossary for the same reason: that reference stops at 599.