HTTP Status Codes

All 94 HTTP status codes in one reference: what each one means, what causes it, how to fix it, and which headers it needs.

• Informational responses (100 to 199): Interim responses. The server acknowledges the request and continues working before sending a final status.
• Successful responses (200 to 299): The request was received, understood, and accepted. The specific code says what the server did with it.
• Redirection messages (300 to 399): Further action is needed to complete the request, usually following a Location header to another URL.
• Client error responses (400 to 499): The request is the problem: malformed, unauthorized, not allowed, or asking for something that is not there.
• Server error responses (500 to 599): The server failed to fulfil an apparently valid request. The fault is on the server side.

• 100 Continue: The server has read the request headers, found nothing wrong with them, and is ready for the client to send the request body.
• 101 Switching Protocols: The server is switching the connection to the protocol the client asked for in the Upgrade header.
• 102 Processing: WebDAV interim response telling the client that a long-running request is still being worked on so it does not time out.
• 103 Early Hints: An interim response carrying Link headers so the browser can start preloading assets before the final response is ready.
• 200 OK: The request succeeded. What the body contains depends on the method that was used.
• 201 Created: The request succeeded and created one or more new resources, identified by the Location header.
• 202 Accepted: The request was accepted for processing, but the work has not finished and may still fail.
• 203 Non-Authoritative Information: The request succeeded, but an intermediary modified the payload it received from the origin server.
• 204 No Content: The request succeeded and the server has deliberately sent no body.
• 205 Reset Content: The request succeeded and the client should reset the document view that sent it, typically clearing a form.
• 206 Partial Content: The server is returning only the byte ranges the client asked for in the Range header.
• 207 Multi-Status: WebDAV response carrying an XML body with a separate status for each resource affected by the request.
• 208 Already Reported: WebDAV binding extension code used inside a 207 body to avoid repeating members that were already listed.
• 218 This Is Fine: Non-standard code used by cPanel builds of Apache in place of a 4xx or 5xx so that the response body still reaches the client.
• 226 IM Used: The response is the result of applying one or more instance manipulations, such as a delta, to the current representation.
• 300 Multiple Choices: The request has more than one possible representation and the server is asking the client to pick one.
• 301 Moved Permanently: The resource has a new permanent URL, given in Location. Clients and search engines should update their references.
• 302 Found: The resource is temporarily at a different URL. Keep using the original URL for future requests.
• 303 See Other: The result of the request is at another URL that should be fetched with GET, whatever method was originally used.
• 304 Not Modified: The cached copy the client already holds is still current, so the server sends no body.
• 305 Use Proxy: Deprecated. Originally told the client to repeat the request through the proxy named in Location.
• 306 (Unused): Reserved. Defined in a draft as Switch Proxy, never standardized, and now permanently unused.
• 307 Temporary Redirect: Same as 302 but the request method and body must be preserved when following the redirect.
• 308 Permanent Redirect: Same as 301 but the request method and body must be preserved when following the redirect.
• 400 Bad Request: The server will not process the request because something about it is malformed.
• 401 Unauthorized: The request lacks valid authentication credentials for the target resource.
• 402 Payment Required: Reserved for future use. In practice, APIs use it to signal a billing problem such as an exhausted quota or an unpaid invoice.
• 403 Forbidden: The server understood the request and refuses to authorize it. Authenticating again will not help.
• 404 Not Found: The server has no representation for the target URL and will not say whether it ever did.
• 405 Method Not Allowed: The URL exists but does not support the HTTP method that was used.
• 406 Not Acceptable: The server cannot produce a response matching the Accept headers on the request.
• 407 Proxy Authentication Required: The proxy between the client and the destination requires credentials before it will forward the request.
• 408 Request Timeout: The server gave up waiting for the client to finish sending the request.
• 409 Conflict: The request conflicts with the current state of the resource, so it cannot be applied as sent.
• 410 Gone: The resource has been permanently removed and no forwarding address exists.
• 411 Length Required: The server refuses the request because it did not declare a Content-Length.
• 412 Precondition Failed: A conditional header on the request evaluated to false, so the server did not perform the method.
• 413 Content Too Large: The request body is larger than the server is willing or able to process.
• 414 URI Too Long: The request target is longer than the server is willing to interpret.
• 415 Unsupported Media Type: The body is in a format the server does not support for this resource and method.
• 416 Range Not Satisfiable: None of the ranges in the Range header overlap the current size of the resource.
• 417 Expectation Failed: The expectation in the request's Expect header cannot be met by the server.
• 418 I'm a Teapot: An April Fools joke from the Hyper Text Coffee Pot Control Protocol, permanently reserved so it can never be reused.
• 419 Page Expired: Laravel's code for a missing or expired CSRF token, most often seen when a form is submitted after the session lapsed.
• 420 Enhance Your Calm / Method Failure: Two unrelated legacy meanings: rate limiting in the old Twitter API, and a failed method in early Spring versions.
• 421 Misdirected Request: The request reached a server that is not configured to produce a response for the requested authority.
• 422 Unprocessable Content: The request is syntactically valid but semantically wrong, so the server cannot act on it.
• 423 Locked: WebDAV code meaning the target resource is locked and the request cannot proceed without the lock token.
• 424 Failed Dependency: The request failed because an earlier request it depended on failed.
• 425 Too Early: The server refuses to process a request sent in TLS 1.3 early data because it might be a replay.
• 426 Upgrade Required: The server refuses the request on the current protocol and names the protocol the client must switch to.
• 428 Precondition Required: The server requires the request to be conditional, so unconditional writes are rejected.
• 429 Too Many Requests: The client has sent too many requests in a given period and is being rate limited.
• 430 Shopify Security Rejection: Shopify's code for a request rejected by its security layer, often too many URLs in a single request.
• 431 Request Header Fields Too Large: The request headers are collectively or individually too large for the server to process.
• 440 Login Time-out: IIS code meaning the client session has expired and the user must sign in again.
• 444 No Response: Internal nginx code that closes the connection without sending any response at all.
• 449 Retry With: IIS code telling the client to retry after supplying additional information the server needs.
• 450 Blocked by Windows Parental Controls: Legacy Windows code indicating that parental control settings blocked access to the page.
• 451 Unavailable For Legal Reasons: Access is denied because of a legal demand, such as a court order or a statutory blocking requirement.
• 460 Client Closed Connection (Load Balancer): AWS load balancer code logged when the client closed the connection before the load balancer could respond.
• 463 X-Forwarded-For Too Long: AWS load balancer code for a request whose X-Forwarded-For header contains more than 30 addresses.
• 464 Incompatible Protocol Versions: AWS load balancer code for a mismatch between the client protocol version and the target group's expected version.
• 494 Request Header Too Large: Internal nginx code for a request whose headers exceeded the configured buffer, logged before a 400 is returned.
• 495 SSL Certificate Error: Internal nginx code for a client certificate that was provided but failed verification.
• 496 SSL Certificate Required: Internal nginx code for a request that omitted a required client certificate.
• 497 HTTP Request Sent to HTTPS Port: Internal nginx code for a plaintext HTTP request that arrived on a port configured for TLS.
• 498 Invalid Token: ArcGIS code for an expired or otherwise invalid authentication token.
• 499 Client Closed Request: nginx logs 499 when the client disconnects before a response is sent. Esri uses the same number for a missing token.
• 500 Internal Server Error: The server hit an unexpected condition and cannot say anything more specific about it.
• 501 Not Implemented: The server does not support the functionality required to fulfil the request, usually the method itself.
• 502 Bad Gateway: A server acting as a gateway or proxy received an invalid response from the upstream server it contacted.
• 503 Service Unavailable: The server is temporarily unable to handle the request, typically because it is overloaded or down for maintenance.
• 504 Gateway Timeout: A gateway or proxy did not receive a timely response from the upstream server it needed to complete the request.
• 505 HTTP Version Not Supported: The server does not support the major HTTP version used in the request.
• 506 Variant Also Negotiates: A content negotiation misconfiguration: the chosen variant is itself a negotiable resource, creating a circular reference.
• 507 Insufficient Storage: The server cannot store the representation needed to complete the request.
• 508 Loop Detected: The server terminated the operation because it encountered an infinite loop while processing it.
• 509 Bandwidth Limit Exceeded: Shared hosting code indicating the account exceeded its allotted bandwidth for the billing period.
• 510 Not Extended: Obsolete. The server required further extensions to the request before it could fulfil it.
• 511 Network Authentication Required: The client must authenticate with the network itself, typically a captive portal on public Wi-Fi.
• 520 Web Server Returned an Unknown Error: Cloudflare's catch-all: the origin returned something empty, malformed, or otherwise unintelligible.
• 521 Web Server Is Down: Cloudflare could not open a connection to the origin because it refused the connection.
• 522 Connection Timed Out: Cloudflare's TCP handshake with the origin did not complete within the allowed time.
• 523 Origin Is Unreachable: Cloudflare could not reach the origin at all, usually a DNS or routing failure.
• 524 A Timeout Occurred: Cloudflare connected to the origin but the origin did not send a complete response within the time limit.
• 525 SSL Handshake Failed: The TLS handshake between Cloudflare and the origin failed.
• 526 Invalid SSL Certificate: The origin presented a TLS certificate that could not be validated.
• 527 Railgun Error: Deprecated Cloudflare code for a connection failure between the edge and a Railgun listener.
• 529 Site Is Overloaded: Non-standard code used by a few platforms to indicate the site is overloaded and shedding requests.
• 530 Site Is Frozen / Cloudflare Error: Cloudflare pairs 530 with a specific 1xxx error code, and some platforms use it for a site frozen by the provider.
• 561 Unauthorized (Load Balancer): AWS load balancer code logged when an identity provider returned an error during authentication.
• 598 Network Read Timeout Error: Non-standard proxy code indicating a network read timeout behind the proxy.
• 599 Network Connect Timeout Error: Non-standard proxy code indicating the proxy could not establish a connection to the upstream in time.