HTTP Status Codes Reference
Every HTTP response starts with a three-digit status code that tells the client what happened. Browse the codes by class, with plain-English explanations, example responses and what each one means for redirects and SEO.
1xx Informational
The request was received and processing continues. These interim responses arrive before the final response and never end a redirect chain.
- 100
Continue
Interim response: the server accepted the request headers and the client, which sent "Expect: 100-continue", should now send the request body. - 101
Switching Protocols
The server accepts the client's Upgrade request and switches this connection to another protocol, in practice almost always WebSocket. - 102
Processing
Obsolete WebDAV interim response telling the client that the server is still working on a long request and that it should keep waiting. - 103
Early Hints
Interim response that sends Link headers before the final response, so browsers can preload assets or preconnect while the server is still working.
2xx Success
The request was received, understood and accepted. A healthy redirect chain ends on one of these, usually 200 OK.
- 200
OK
The request succeeded; for GET the body contains the requested resource. Every redirect chain should end on a URL that returns 200. - 201
Created
The request succeeded and created a new resource, usually after POST or PUT. The Location header, if present, points to the new resource. - 202
Accepted
The request was accepted for processing but is not finished yet. Used for asynchronous jobs; the final outcome is not guaranteed. - 203
Non-Authoritative Information
The request succeeded, but a transforming proxy modified the response, so the content is not exactly what the origin server sent. - 204
No Content
The request succeeded and there is no content to send. Browsers stay on the current page; common for DELETE, beacons and CORS preflight. - 205
Reset Content
The request succeeded and the client should reset the document view, for example clear the form that was just submitted. - 206
Partial Content
The server sends only the byte ranges the client asked for with a Range header, as used for video streaming and resumable downloads. - 207
Multi-Status
WebDAV response that carries a separate status code for each of several resources or properties in an XML multistatus body. - 208
Already Reported
Used inside a WebDAV 207 response: members of this collection were already listed earlier, which avoids endless repeats when bindings loop. - 226
IM Used
The server answered a GET with delta encoding (RFC 3229): the body contains only the changes from a version the client already has.
3xx Redirection
The client has to take further action, usually by requesting the URL in the Location header. These are the codes that make up a redirect chain.
- 300
Multiple Choices
The resource has several representations and the client may choose one. Browsers do not follow a 300 automatically, even with a Location header. - 301
Moved Permanently
The resource has a new permanent URL, given in the Location header. Clients and search engines should use the new URL from now on. - 302
Found
The resource is temporarily at another URL. Clients follow the Location header but should keep using the original URL in the future. - 303
See Other
Redirects the client to another URL that it must fetch with GET, typically to show a result page after a form submission (Post/Redirect/Get). - 304
Not Modified
Answer to a conditional GET or HEAD: the client's cached copy is still valid, so the server sends no body and the cached copy is reused. - 305
Use Proxy
Deprecated. Told the client to repeat the request through the proxy given in Location; browsers ignore it for security reasons. - 306
Unused (formerly Switch Proxy)
Reserved and unused. 306 was once proposed as "Switch Proxy" but dropped; it must not be used, and clients treat it as an unknown 3xx code. - 307
Temporary Redirect
Temporary redirect that must repeat the request with the same method and body at the Location URL, unlike 302, which may turn POST into GET. - 308
Permanent Redirect
Permanent redirect that keeps the request method and body. Like 301, the new URL should be used from now on, but POST never turns into GET.
4xx Client Error
The request can't be fulfilled as sent: the page doesn't exist, access is denied or the client has sent too many requests.
- 400
Bad Request
The server will not process the request because of a client error, such as malformed syntax, an invalid URL or oversized cookies. - 401
Unauthorized
The request needs valid authentication. The server must send a WWW-Authenticate header saying how to authenticate, for example Basic or Bearer. - 402
Payment Required
Reserved by HTTP for future use. In practice some APIs and services use it when a payment, credit or subscription is needed. - 403
Forbidden
The server understood the request but refuses to authorize it. Unlike with 401, simply sending the same credentials again will not help. - 404
Not Found
The server has nothing at this URL, or will not say whether something exists. It does not say whether the absence is temporary or permanent. - 405
Method Not Allowed
The URL exists but does not support the HTTP method used, for example POST to a static page. The Allow header lists the supported methods. - 406
Not Acceptable
The server cannot produce a response that matches the client's Accept headers (format, language, encoding) and will not send a default. - 407
Proxy Authentication Required
Like 401, but a proxy between the client and the server requires authentication. The Proxy-Authenticate header says how to authenticate. - 408
Request Timeout
The server did not receive a complete request in time and closes the connection. The client may send the request again on a new connection. - 409
Conflict
The request conflicts with the current state of the resource, for example an edit conflict, a duplicate record or a version mismatch. - 410
Gone
The resource was removed on purpose and is not expected to return. A more explicit, permanent signal than 404 Not Found. - 411
Length Required
The server refuses a request with a body but no Content-Length header. The client can send it again with a valid Content-Length. - 412
Precondition Failed
A condition in the request headers, such as If-Match or If-Unmodified-Since, was false, so the server did not apply the change. - 413
Content Too Large
The request body is larger than the server accepts, as with oversized uploads. Formerly named "Payload Too Large" and "Request Entity Too Large". - 414
URI Too Long
The requested URL is longer than the server will process, for example because a redirect loop keeps appending parameters to the URL. - 415
Unsupported Media Type
The server refuses the request body because its format (Content-Type) or its content coding (Content-Encoding) is not supported. - 416
Range Not Satisfiable
The byte range in the request's Range header lies outside the file, as when a download resumes beyond the end of a changed file. - 417
Expectation Failed
The server cannot meet the expectation in the request's Expect header. In practice this means that Expect: 100-continue is not supported. - 418
I'm a Teapot
An April Fools' joke from the 1998 coffee pot protocol (RFC 2324). Reserved as unused in HTTP, but some sites return it on purpose. - 421
Misdirected Request
The request reached a server that cannot answer for this host name, often because of a TLS SNI mismatch or a reused HTTP/2 connection. - 422
Unprocessable Content
The request is well-formed but its content is semantically invalid, typically a validation error in an API. Formerly "Unprocessable Entity". - 423
Locked
WebDAV: the resource is locked, so the method cannot be applied right now. The client needs the lock token or has to wait for the lock to end. - 424
Failed Dependency
WebDAV: the method could not be performed because another action it depended on failed, for example a single property in a PROPPATCH. - 425
Too Early
The server will not process a request sent as TLS early data (0-RTT), because it could be replayed. The client retries after the handshake. - 426
Upgrade Required
The server refuses to handle the request over the current protocol and requires an upgrade to the protocol named in the Upgrade header. - 428
Precondition Required
The server requires the request to be conditional (If-Match) to prevent lost updates when several clients edit the same resource. - 429
Too Many Requests
The client sent too many requests in a given time (rate limiting). A Retry-After header may say how long to wait before trying again. - 431
Request Header Fields Too Large
The server refuses the request because its headers are too large, usually because the browser sends too many or too large cookies. - 444
No Response
nginx Non-standard nginx code: the server closes the connection without sending any response. Clients see an empty reply and never a 444. - 451
Unavailable For Legal Reasons
Access is denied because of a legal demand, such as a court order or government block. Named after Ray Bradbury's novel Fahrenheit 451. - 499
Client Closed Request
nginx Non-standard code that nginx writes to its access log when the client closed the connection before the server had sent its response.
5xx Server Error
The server failed to fulfil an apparently valid request. Persistent 5xx errors block visitors and crawlers alike.
- 500
Internal Server Error
Generic server-side failure: something went wrong on the server, such as an application crash or a broken configuration file. - 501
Not Implemented
The server does not support the functionality needed to fulfill the request, typically an HTTP method that it does not recognise. - 502
Bad Gateway
A gateway or proxy got an invalid response from the upstream server, for example because the application behind nginx crashed. - 503
Service Unavailable
The server is temporarily unable to handle the request because of overload or maintenance. Retry-After can say when to try again. - 504
Gateway Timeout
A gateway or proxy did not get a response from the upstream server in time, typically because the application is too slow. - 505
HTTP Version Not Supported
The server does not support, or refuses to support, the major HTTP version used in the request. Today it often hints at a malformed request line. - 506
Variant Also Negotiates
Server configuration error in transparent content negotiation (RFC 2295): the chosen variant is itself negotiable, which creates a loop. - 507
Insufficient Storage
WebDAV: the server cannot store the data needed to complete the request, for example because a disk or user quota is full. - 508
Loop Detected
WebDAV: the server stopped a Depth: infinity operation because it found an infinite loop of bindings. Not related to redirect loops. - 510
Not Extended
From the obsolete HTTP Extension Framework (RFC 2774): the request lacks a required extension declaration. Historic and effectively unused. - 511
Network Authentication Required
The network, usually a Wi-Fi captive portal, requires sign-in before granting access. Sent by intercepting networks, not by origin servers. - 520
Web Server Returned an Unknown Error
Cloudflare Cloudflare-specific: the origin server returned an empty, unknown or unexpected response, for example after a crash or a reset connection. - 521
Web Server Is Down
Cloudflare Cloudflare-specific: the origin server refused the connection from Cloudflare, usually because the web server is down or blocks Cloudflare. - 522
Connection Timed Out
Cloudflare Cloudflare-specific: Cloudflare could not complete a TCP connection to the origin in time, or the origin did not acknowledge the request. - 523
Origin Is Unreachable
Cloudflare Cloudflare-specific: Cloudflare cannot reach the origin at all, typically because of a routing problem or a wrong origin IP address in DNS. - 524
A Timeout Occurred
Cloudflare Cloudflare-specific: Cloudflare connected to the origin but got no HTTP response before its read timeout, about two minutes by default. - 525
SSL Handshake Failed
Cloudflare Cloudflare-specific: the TLS handshake between Cloudflare and the origin failed, for example because the origin has no valid certificate. - 526
Invalid SSL Certificate
Cloudflare Cloudflare-specific: in Full (strict) mode, Cloudflare could not validate the origin's certificate, e.g. it is expired, self-signed or for another name. - 530
Cloudflare 1xxx Error
Cloudflare Cloudflare-specific: sent together with a Cloudflare 1xxx error, for example 1016 (Origin DNS error) or 1033 (Cloudflare Tunnel error).
How to read an HTTP status code
The first digit gives the class of the response, and the other two identify the exact meaning within that class. A client that doesn't recognise a specific code treats it like the x00 code of its class, so an unknown 4xx code is handled like 400 Bad Request.
The reason phrase after the number, such as Not Found or Moved Permanently, is only a description for humans. Clients act on the number alone, and HTTP/2 and HTTP/3 don't send a reason phrase at all.
Redirect status codes at a glance
- 301 Moved Permanently: permanent; browsers may change a POST into a GET. The default choice for moved pages.
- 302 Found: temporary; the method may change. The default in many frameworks.
- 303 See Other: temporary; always followed with GET. Used after form submissions.
- 307 Temporary Redirect: temporary; the method and body are preserved.
- 308 Permanent Redirect: permanent; the method and body are preserved.
- 304 Not Modified: not a redirect to another URL, but a signal that the client's cached copy is still valid.
Read HTTP redirect status codes explained to learn when to use each one.
Status codes in a redirect chain
A redirect chain is a series of 3xx responses that ends on a final response. Only the last status code is what the visitor or crawler actually gets, so a chain that ends on a 404 is a broken link, however clean the redirects before it look. Use the URL redirect checker to see the status code of every hop, or the Bulk Redirect Checker to check many URLs at once.
URL Redirect Checker
See every status code a URL returns, hop by hop, with the free TrueURL redirect checker.