511 Network Authentication Required (RFC 6585) means the client needs to authenticate to gain network access. It is intended for captive portals: the login or terms pages of hotel, airport and café Wi-Fi networks, which intercept web traffic until the user signs in.
The response should contain a link, or a meta refresh, to the login page. Origin servers should not generate 511; it is meant for network infrastructure that intercepts the request. Caches must not store a 511. A dedicated code, instead of a redirect, keeps clients from mistaking the portal's page for the site they requested and from caching it.
Operating systems detect captive portals separately, by fetching known test URLs, and open the login page automatically.
Example response
HTTP/1.1 511 Network Authentication Required
Date: Fri, 06 Nov 2026 10:15:32 GMT
Cache-Control: no-store
Content-Type: text/html; charset=utf-8
Content-Length: 240
<!doctype html>
<title>Network Authentication Required</title>
<meta http-equiv="refresh" content="0; url=https://login.wifi.example.net/">
<p>You need to <a href="https://login.wifi.example.net/">sign in to the Wi-Fi network</a> first.</p>SEO and redirect checking
A 511 never comes from your website, so it does not affect SEO. TrueURL checks run in Cloudflare's network, not on your local Wi-Fi, so a 511 in a result would be unusual. If your browser shows one, sign in to the network first.
Common causes and use cases
- A hotel, airport, train or café Wi-Fi network requires accepting terms or entering a code.
- A company guest network requires registration.
- The captive portal session expired, and the network intercepts requests again.