HTTP Status Codes
Every HTTP status code explained in one plain sentence. Runs in your browser.
About this http status codes
This is a searchable list of every HTTP status code in the IANA registry, from 100 Continue to 511 Network Authentication Required, with one plain-English sentence for each. It is for developers debugging an API, SEO people checking redirects, and anyone who just got a 403 and wants to know what it means.
Each code opens to show when you see it, what usually causes it, how to fix it, whether it is cacheable by default, and the exact RFC section that defines it. Names follow the IANA HTTP Status Code Registry, last updated 15 September 2025, and the core definitions come from RFC 9110, the current HTTP semantics standard.
Common codes that are not in the registry, such as nginx's 499 and Cloudflare's 52x errors, are listed separately and marked as unofficial, so you never mistake a vendor code for a standard one.
Features
All 64 registered codes
Every code IANA lists, including the reserved 306 and 418, the obsolete 510 and the temporary 104 registration, each labelled for what it is.
Search that understands codes
Type 404 for an exact code, 50 for every code starting with 50, 4xx for a whole class, or words like rate limit, cache or redirect.
Causes and fixes
Beyond the one-liner, each entry says when the code shows up in practice and what to check first, such as the upstream app for a 502 or the Retry-After header for a 429.
Source for every entry
Each code shows the RFC and section that defines it, so you can cite it in a ticket or a spec review.
Unofficial codes, clearly marked
nginx (444, 499), Cloudflare (520 to 526, 530), Laravel (419), IIS (440) and a few others, kept apart from the standard list.
Redirect chooser
A small table compares 301, 302, 303, 307 and 308 on two questions: is it permanent, and does it keep the request method?
Shareable links
Opening a code puts it in the address bar (?code=429), so you can send a colleague straight to it.
How to use the http status codes
- 1Search by number, class (4xx) or words like rate limit.
- 2Open a code to see what causes it, how to fix it and where it is defined.
- 3Copy the one-line description for docs, tickets or error pages.
When to use it
Debugging an API call
Your fetch call returns 415. Search it, read that the server rejects the body format, and check that you sent Content-Type: application/json.
Choosing the right redirect
Moving a page for good? 301 for normal pages, 308 if POST requests must keep working. For a form submission, 303 sends the user to the result page with GET.
Reading server logs
Spot a wave of 499 in nginx logs and learn that clients are giving up before your backend answers, which points to a slow endpoint, not a crash.
Writing API docs
Copy the one-line description of 409 or 422 into your error reference so your wording matches the standard.
What are HTTP status codes?
An HTTP status code is the three-digit number at the start of every server response. It tells the client how the request went before it reads a single byte of the body. The first digit sets the class: 1xx informational, 2xx success, 3xx redirection, 4xx client error and 5xx server error.
RFC 9110 says a client that gets a code it does not recognise must treat it like the x00 code of the same class. An unknown 299 is handled as 200, an unknown 431 as 400. That rule is why new codes can be added without breaking old software.
1xx informational codes
Interim responses. The final response for the same request still follows.
- 100 Continue: The server got the request headers and the client should go ahead and send the body. (RFC 9110, Section 15.2.1)
- 101 Switching Protocols: The server agrees to switch to the protocol named in the client's Upgrade header. (RFC 9110, Section 15.2.2)
- 102 Processing: The server has accepted a long WebDAV request and is still working on it. (RFC 2518)
- 103 Early Hints: A preview of headers, usually Link preload hints, sent before the final response. (RFC 8297)
- 104 Upload Resumption Supported: The server tells the client that an interrupted upload can be resumed later. (draft-ietf-httpbis-resumable-upload)
2xx success codes
The request was received, understood and accepted.
- 200 OK: The request worked, and the body holds the result. (RFC 9110, Section 15.3.1)
- 201 Created: The request worked and created a new resource. (RFC 9110, Section 15.3.2)
- 202 Accepted: The request was accepted for processing, but the work is not finished yet. (RFC 9110, Section 15.3.3)
- 203 Non-Authoritative Information: Success, but a proxy changed the origin server's 200 response on the way. (RFC 9110, Section 15.3.4)
- 204 No Content: The request worked and there is nothing to send back. (RFC 9110, Section 15.3.5)
- 205 Reset Content: The request worked, and the client should reset the form or view that sent it. (RFC 9110, Section 15.3.6)
- 206 Partial Content: The server is sending only the byte range the client asked for. (RFC 9110, Section 15.3.7)
- 207 Multi-Status: A WebDAV response that carries a separate status for each of several resources. (RFC 4918)
- 208 Already Reported: Inside a WebDAV 207 body, these members were already listed earlier in the same response. (RFC 5842)
- 226 IM Used: The server sent the result of instance manipulations, such as a delta, instead of the full resource. (RFC 3229)
3xx redirection codes
The client must take another step, usually following the Location header, to complete the request.
- 300 Multiple Choices: The resource has several representations and the client may pick one. (RFC 9110, Section 15.4.1)
- 301 Moved Permanently: The resource has a new permanent URL, given in the Location header. (RFC 9110, Section 15.4.2)
- 302 Found: The resource is temporarily at another URL; keep using the original one. (RFC 9110, Section 15.4.3)
- 303 See Other: Go and GET a different URL to see the result of this request. (RFC 9110, Section 15.4.4)
- 304 Not Modified: Your cached copy is still current, so the server sends no body. (RFC 9110, Section 15.4.5)
- 305 Use Proxy: Deprecated. It once told the client to repeat the request through a proxy. (RFC 9110, Section 15.4.6)
- 306 (Unused): Reserved. It was used in an earlier draft and is no longer used. (RFC 9110, Section 15.4.7)
- 307 Temporary Redirect: Temporarily at another URL; repeat the request there with the same method and body. (RFC 9110, Section 15.4.8)
- 308 Permanent Redirect: Moved permanently; repeat the request at the new URL with the same method and body. (RFC 9110, Section 15.4.9)
4xx client error codes
Something about the request is wrong. Sending it again unchanged will usually fail again.
- 400 Bad Request: The server cannot or will not process the request because something in it is malformed. (RFC 9110, Section 15.5.1)
- 401 Unauthorized: The request has no valid credentials. Log in or send a valid token and try again. (RFC 9110, Section 15.5.2)
- 402 Payment Required: Reserved for future use. (RFC 9110, Section 15.5.3)
- 403 Forbidden: The server understood the request and refuses it. Logging in again will not help. (RFC 9110, Section 15.5.4)
- 404 Not Found: The server has nothing at this URL. (RFC 9110, Section 15.5.5)
- 405 Method Not Allowed: The URL exists but does not accept this method, such as a POST to a read-only page. (RFC 9110, Section 15.5.6)
- 406 Not Acceptable: The server has no version of the resource that matches the client's Accept headers. (RFC 9110, Section 15.5.7)
- 407 Proxy Authentication Required: Like 401, but it is the proxy in between that wants credentials. (RFC 9110, Section 15.5.8)
- 408 Request Timeout: The server gave up waiting for the client to finish sending the request. (RFC 9110, Section 15.5.9)
- 409 Conflict: The request conflicts with the current state of the resource. (RFC 9110, Section 15.5.10)
- 410 Gone: The resource was removed on purpose and is not coming back. (RFC 9110, Section 15.5.11)
- 411 Length Required: The server needs a Content-Length header and the request did not have one. (RFC 9110, Section 15.5.12)
- 412 Precondition Failed: A condition in the request headers, such as If-Match, turned out false. (RFC 9110, Section 15.5.13)
- 413 Content Too Large: The request body is bigger than the server is willing to accept. (RFC 9110, Section 15.5.14)
- 414 URI Too Long: The URL is longer than the server will handle. (RFC 9110, Section 15.5.15)
- 415 Unsupported Media Type: The server does not accept the body's format, as given in Content-Type or Content-Encoding. (RFC 9110, Section 15.5.16)
- 416 Range Not Satisfiable: The requested byte range lies outside the resource. (RFC 9110, Section 15.5.17)
- 417 Expectation Failed: The server cannot meet the requirement in the request's Expect header. (RFC 9110, Section 15.5.18)
- 418 (Unused): Reserved. Known as I'm a teapot from an April Fools' RFC, so it will never get a real meaning. (RFC 9110, Section 15.5.19)
- 421 Misdirected Request: The request reached a server that cannot answer for this host name or scheme. (RFC 9110, Section 15.5.20)
- 422 Unprocessable Content: The request is well formed, but its content fails validation. (RFC 9110, Section 15.5.21)
- 423 Locked: WebDAV: the resource is locked, so it cannot be changed right now. (RFC 4918)
- 424 Failed Dependency: WebDAV: this action failed because an action it depended on failed. (RFC 4918)
- 425 Too Early: The server will not risk processing a request that might be replayed. (RFC 8470)
- 426 Upgrade Required: The server will only answer after the client switches to another protocol. (RFC 9110, Section 15.5.22)
- 428 Precondition Required: The server requires a conditional request, such as one with If-Match. (RFC 6585)
- 429 Too Many Requests: The client sent too many requests in a given time. Slow down. (RFC 6585)
- 431 Request Header Fields Too Large: The request headers, or one header, are too big for the server. (RFC 6585)
- 451 Unavailable For Legal Reasons: The server cannot provide this resource because of a legal demand. (RFC 7725)
5xx server error codes
The server failed to answer a request that may well be valid.
- 500 Internal Server Error: Something went wrong on the server and it has no more specific code for it. (RFC 9110, Section 15.6.1)
- 501 Not Implemented: The server does not support the functionality needed, typically the request method. (RFC 9110, Section 15.6.2)
- 502 Bad Gateway: A gateway or proxy got an invalid response from the server behind it. (RFC 9110, Section 15.6.3)
- 503 Service Unavailable: The server cannot handle the request right now, because of overload or maintenance. (RFC 9110, Section 15.6.4)
- 504 Gateway Timeout: A gateway or proxy waited too long for the server behind it to answer. (RFC 9110, Section 15.6.5)
- 505 HTTP Version Not Supported: The server does not support the HTTP version used in the request. (RFC 9110, Section 15.6.6)
- 506 Variant Also Negotiates: The server's content negotiation is misconfigured: the chosen variant negotiates again. (RFC 2295)
- 507 Insufficient Storage: WebDAV: the server does not have the space to store what the request needs. (RFC 4918)
- 508 Loop Detected: WebDAV: the server stopped because it found an infinite loop. (RFC 5842)
- 510 Not Extended: Obsoleted. It meant the request needed an HTTP extension that it did not declare. (RFC 2774)
- 511 Network Authentication Required: You need to log in to the network, such as hotel or airport Wi-Fi, before you can browse. (RFC 6585)
Unofficial status codes you will see in the wild
These are not in the IANA registry and no standard defines them. Products use them internally or send them to clients. Treat them as product-specific, and do not send them from your own API.
- 419 Page Expired (Laravel): Laravel's answer when a form's CSRF token is missing or has expired.
- 420 Enhance Your Calm (Twitter API v1 (retired)): The old Twitter API's rate-limit code, replaced by the standard 429.
- 440 Login Time-out (Microsoft IIS): IIS and Exchange: the session expired and the user must log in again.
- 444 No Response (nginx): nginx closed the connection without sending any response at all.
- 494 Request Header Too Large (nginx): nginx's internal code for request headers that exceed its buffers.
- 495 SSL Certificate Error (nginx): nginx: the client certificate in a mutual TLS setup is invalid.
- 496 SSL Certificate Required (nginx): nginx: a client certificate is required and none was sent.
- 497 HTTP Request Sent to HTTPS Port (nginx): nginx: plain HTTP arrived on a port that expects HTTPS.
- 499 Client Closed Request (nginx): nginx: the client hung up before the server finished answering.
- 509 Bandwidth Limit Exceeded (Apache / cPanel hosting): The hosting account went over its bandwidth allowance.
- 520 Web Server Returned an Unknown Error (Cloudflare): Cloudflare got an empty or unexpected response from the origin server.
- 521 Web Server Is Down (Cloudflare): Cloudflare could not connect to the origin server at all.
- 522 Connection Timed Out (Cloudflare): Cloudflare's connection attempt to the origin timed out.
- 523 Origin Is Unreachable (Cloudflare): Cloudflare cannot reach the origin, often because of DNS or routing.
- 524 A Timeout Occurred (Cloudflare): Cloudflare connected to the origin, but it did not send a response in time.
- 525 SSL Handshake Failed (Cloudflare): The TLS handshake between Cloudflare and the origin failed.
- 526 Invalid SSL Certificate (Cloudflare): The origin's certificate failed Cloudflare's validation in Full (strict) mode.
- 530 Origin Error (Cloudflare): Cloudflare returns it together with a 1xxx error page that names the real problem.
What is the difference between 401 and 403?
401 Unauthorized means the request did not prove who you are: no token, an expired session or a wrong password. Logging in can fix it, and the server must send a WWW-Authenticate header saying how. 403 Forbidden means the server knows who you are, or does not care, and refuses anyway. Logging in again will not change the answer.
A related trick: servers may answer 404 instead of 403 to hide that a private resource exists at all. RFC 9110 allows this.
Why use Mavros
| Mavros | Typical upload sites | |
|---|---|---|
| Coverage | All 64 IANA codes plus marked unofficial ones | Common codes only, or vendor codes mixed in |
| Sources | RFC and section for every code | Rarely cited |
| Registry date | Matches the 2025-09-15 IANA update, with current names like 413 Content Too Large | Old names such as Payload Too Large |
| Search | By number, prefix, class or words | Scroll a long page |
| Practical detail | Causes, fixes and cacheability | One-line definition |
| Ads and trackers | None, the list is part of the page | Heavy ads |
Tips
- Do not return 200 with an error message in the body. Clients, caches and monitoring all trust the status code, so a failed request should carry a 4xx or 5xx code.
- For validation errors in a JSON API, 422 is more precise than 400. Keep 400 for requests the server cannot parse at all.
- Send Retry-After with 429 and 503 so well-behaved clients know when to come back.
- Testing a status code in a token-protected API? Decode the token first with the JWT decoder, and break a long request URL into parts with the URL parser.
- Checking redirects for SEO? Pair this list with the .htaccess redirect generator and keep permanent moves on 301 or 308.
Questions
What does a 404 status code mean?
404 Not Found means the server has nothing at that URL. It does not say whether the page was moved, deleted or never existed. Check the URL for typos; if the page is gone for good, the site should return 410 Gone instead.
What is the difference between 500 and 502?
500 means the server itself hit an unexpected error, usually a bug or bad configuration. 502 means a proxy or gateway, such as nginx or a load balancer, got an invalid answer from the server behind it, which often means the app is down or restarting.
What is the difference between 301 and 308?
Both are permanent redirects. With 301, clients may change a POST into a GET when they follow it, for historical reasons. 308 forbids that, so the method and body stay the same. Use 301 for web pages and 308 for API endpoints.
Is 418 I'm a teapot a real status code?
It is reserved but not assigned. It comes from RFC 2324, a 1998 April Fools' joke, and was implemented so widely that RFC 9110 reserved 418 so no real meaning can take it. Do not use it in production APIs.
What does 429 Too Many Requests mean?
You hit a rate limit. The server is asking you to slow down, and it may send a Retry-After header with the number of seconds to wait. Back off and retry later, with increasing delays if it happens again.
Which status codes are cacheable by default?
RFC 9110 lists 200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414 and 501 as heuristically cacheable. Caches may store them without explicit headers. Any other code needs Cache-Control or Expires to be cached.
What does 499 mean in nginx logs?
499 is nginx's own code for "client closed request": the client disconnected before nginx sent a response. It never reaches the client. Lots of 499s on one URL usually mean that endpoint is too slow.
Where is the official list of HTTP status codes?
IANA keeps it in the HTTP Status Code Registry at iana.org. Most entries point to RFC 9110 (June 2022), which replaced RFC 7231 and the older HTTP/1.1 documents. This page follows the registry's September 2025 update.