HTTP Status Codes
74 status codes with plain-English meanings and the practical fix for each — including the non-standard ones nginx, IIS, Cloudflare and AWS emit.
Look one up
1xx — Informational
The request was received and the server is still working on it. These are interim responses; a final status always follows.
| Code | Name | What it means & what to do |
|---|---|---|
| Continue | The server got the request headers and the client should send the body. Sent automatically by clients handling Expect: 100-continue. You rarely write it by hand. | |
| Switching Protocols | The server is switching to the protocol named in the Upgrade header. This is how WebSocket handshakes succeed. Requires a matching Upgrade and Connection header. | |
| Processing | A WebDAV response meaning the server has accepted the request but has not finished it. Prevents clients from timing out on long multi-step WebDAV operations. | |
| Early Hints | Lets the server send Link headers before the final response so the browser can preload. See it alongside a 200. Great for shaving time off critical CSS/JS fetches. |
2xx — Success
The request was received, understood and accepted.
| Code | Name | What it means & what to do |
|---|---|---|
| OK | The standard success response — the payload is in the body. The default for GET returning data. Prefer 201 or 204 when they fit better. | |
| Created | The request succeeded and a new resource now exists. Send it after a POST that creates something, with a Location header pointing at the new resource. | |
| Accepted | The request was accepted for processing, but processing is not finished. For queued/async jobs. Point the client at a status URL so it can poll. | |
| Non-Authoritative Information | The payload came from a proxy or cache that may have transformed it. Rare. Means the response is not the origin server’s exact bytes. | |
| No Content | The request succeeded but there is deliberately no body. Perfect for DELETE, or a PUT that updates without returning the object. Never include a body. | |
| Reset Content | Like 204, but also asks the client to reset the document view. Used after form submissions to clear the inputs, without navigating. | |
| Partial Content | Only the requested byte range is being returned. The basis of resumable downloads and video seeking. Requires a Range request and a Content-Range response. | |
| Multi-Status | A WebDAV response carrying several independent statuses in one body. Also used by some bulk APIs (e.g. batch endpoints) to report per-item results. | |
| Already Reported | A WebDAV response saying a binding was already reported, so it is skipped. Avoids repeating members across nested multi-status responses. | |
| IM Used | The server fulfilled the request using instance manipulations (delta encoding). Part of the now-rare Delta Encoding in HTTP extension. |
3xx — Redirection
Further action is needed to complete the request — almost always a different URL, or a cached copy.
| Code | Name | What it means & what to do |
|---|---|---|
| Multiple Choices | There are several representations of the resource; the client picks one. Rare. An explicit Location is friendlier than making the client guess. | |
| Moved Permanently | The resource now lives at a new URL, permanently. Search engines transfer ranking signals. Browsers cache it hard — do not use it for temporary moves. | |
| Found | The resource is temporarily at another URL. Historically ambiguous about method rewriting; prefer 303 or 307 when the method matters. | |
| See Other | Fetch the result from a different URL, always with GET. The classic POST → redirect → GET pattern, so a refresh does not resubmit the form. | |
| Not Modified | The cached copy is still fresh — use it, do not download again. Returned when If-None-Match / If-Modified-Since matches. It saves bandwidth but still costs a round trip. | |
| Use Proxy | The client must use the specified proxy to reach the resource. Deprecated for security reasons. Do not emit it. | |
| Temporary Redirect | Same as 302, but the method and body must not change. Use it when a POST must stay a POST after the redirect. | |
| Permanent Redirect | Permanent version of 307 — method and body are preserved. The method-safe counterpart to 301 for API endpoints. |
4xx — Client Error
The request itself is the problem: bad syntax, missing credentials, wrong URL, or too many requests. Retrying the same request usually will not help.
| Code | Name | What it means & what to do |
|---|---|---|
| Bad Request | The server cannot process the request because of client-side syntax or validation errors. Malformed JSON, a missing required field, bad query params. Return a field-level error body — it is the single most common API complaint. | |
| Unauthorized | Authentication is missing or invalid. Despite the name it means “unauthenticated”. Send WWW-Authenticate to say which scheme you accept. | |
| Payment Required | Reserved for payment systems; returned when a plan or quota must be paid for. Increasingly used by APIs to signal “upgrade your plan”. | |
| Forbidden | The server understood the request but refuses to authorise it. Unlike 401, sending credentials again will not help. The caller is known — they just lack permission. | |
| Not Found | No resource matches the URL. Also used to hide the existence of private resources. Keep the response body helpful — offer search or links. | |
| Method Not Allowed | The URL exists, but not for that HTTP method. You must return an Allow header listing the methods that do work. | |
| Not Acceptable | No representation matches the Accept headers the client sent. Common in content-negotiation bugs; check your Accept and Content-Type handling. | |
| Proxy Authentication Required | The client must authenticate with the proxy first. Like 401 but aimed at the proxy. Use Proxy-Authenticate. | |
| Request Timeout | The server gave up waiting for the request. The client was too slow to send. May be a flaky connection or a badly small keep-alive timeout. | |
| Conflict | The request conflicts with the current state of the resource. Duplicate keys, concurrent edit clashes, or optimistic-locking version mismatches. | |
| Gone | The resource existed but has been permanently removed. Stronger than 404 for SEO — search engines drop the URL rather than keeping it pending. | |
| Length Required | The server refuses the request without a Content-Length. Rare. Happens when a chunked request is not supported by the endpoint. | |
| Precondition Failed | A condition in If-Match or If-Unmodified-Since was not met. How lost-update protection surfaces: fetch fresh state and retry. | |
| Content Too Large | The request body exceeds the limit the server is willing to process. Renamed from “Payload Too Large”. Check your upload limit and, on 413, look at nginx client_max_body_size too. | |
| URI Too Long | The requested URL is longer than the server will handle. Usually a GET query string stuffed with too much data — move it to a POST body. | |
| Unsupported Media Type | The body’s format is not supported by the endpoint. Nearly always a missing Content-Type: application/json header. | |
| Range Not Satisfiable | The requested byte range cannot be served. Return Content-Range: bytes */<size> so the client learns the real length. | |
| Expectation Failed | The Expect header could not be met. Usually Expect: 100-continue against a server that does not support it. | |
| I’m a Teapot | An April Fools’ joke from RFC 2324 that developers refused to let die. Some APIs genuinely return it for “you asked a nonsense question”. Harmless, and useful for testing error paths. | |
| Misdirected Request | The request reached a server that cannot answer for that authority. Turns up with HTTP/2 connection coalescing and mismatched TLS SNI. | |
| Unprocessable Content | The syntax was fine but the content is semantically invalid. Renamed from “Unprocessable Entity”. The natural choice for validation errors — prefer it over 400 when the JSON parsed fine. | |
| Locked | A WebDAV resource is locked. Also used by some APIs to mark an account or record as frozen. | |
| Failed Dependency | A WebDAV request failed because a dependent request failed. Appears in batch APIs when one item in a transaction fails. | |
| Too Early | The server is unwilling to risk processing a replayable request. A TLS 1.3 anti-replay defence. Retry after the early-data window closes. | |
| Upgrade Required | The server refuses to serve the request over the current protocol. Send an Upgrade header — used to push clients off TLS 1.0/1.1. | |
| Precondition Required | The server wants the request to be conditional. Forces If-Match on updates to prevent lost updates — a deliberate alternative to optimistic locking. | |
| Too Many Requests | The client has sent too many requests in a given window. Always pair it with Retry-After. Also send RateLimit-* headers so clients can back off intelligently. | |
| Request Header Fields Too Large | The headers exceed the server’s limit. Almost always oversized cookies. Trim them, or raise the limit deliberately. | |
| Unavailable For Legal Reasons | The server is legally prevented from serving the resource. Must be safe to show in the error message the reason and who is blocking it. |
5xx — Server Error
The server failed to fulfil a request that looked valid. The request may work on a retry, ideally with backoff.
| Code | Name | What it means & what to do |
|---|---|---|
| Internal Server Error | The server hit an unexpected condition and could not complete the request. A catch-all — treat it as “a bug”. Never use it for validation or auth failures. | |
| Not Implemented | The server does not support the functionality the request requires. Distinct from 405: the method is unknown, not merely disallowed for that URL. | |
| Bad Gateway | An upstream server returned an invalid response to the gateway. The single most common error behind nginx or a CDN. Check whether the app is actually up and listening. | |
| Service Unavailable | The server is temporarily unable to handle the request. Warm restarts, overload or maintenance. Send Retry-After and consider a static maintenance page. | |
| Gateway Timeout | An upstream server did not respond in time. Raise the proxy read timeout, or make the upstream call faster. Distinguish it from a client-side timeout. | |
| HTTP Version Not Supported | The server does not support the HTTP major version used. Effectively obsolete now that everything speaks HTTP/1.1 or 2+. | |
| Variant Also Negotiates | Content negotiation ended in a circular reference. A server-side misconfiguration with transparent negotiation. | |
| Insufficient Storage | A WebDAV server ran out of space. Also borrowed by APIs for “quota exceeded”. | |
| Loop Detected | A WebDAV request hit an infinite loop while processing. Depth limits or self-referencing collections. | |
| Not Extended | Further extensions to the request are required. The failed extension is named in the response. | |
| Network Authentication Required | The client must authenticate to get network access. How captive portals intercept you before you log in to hotel or café Wi-Fi. |
Non-standard
Codes in wide real-world use that are not defined by RFC 9110 — coined by nginx, IIS, Cloudflare, AWS and friends. Treat them as informative, not contractual.
| Code | Name | What it means & what to do |
|---|---|---|
| Page Expired | The CSRF token or session has expired. Laravel’s convention. Refresh the page to get a fresh token and resubmit. | |
| Enhance Your Calm | You are being rate limited. Originally Twitter’s; now largely folded into 429. | |
| Login Timeout | The session expired and the user was logged out. Microsoft IIS convention. | |
| No Response | The server closed the connection without sending anything. nginx behaviour used to drop malicious or abusive clients. Clients see only a failed connection. | |
| Retry With | The request should be retried with more information. IIS convention, typically used to ask for missing credentials or a required header. | |
| Blocked by Windows Parental Controls | Access blocked by local parental-control software. Legacy Windows/intermediary behaviour. Informative only. | |
| Client Closed Request | The client disconnected before the response was ready. AWS Elastic Load Balancer logs this when a backend waits past the idle timeout. | |
| Client Closed Request | The client gave up and hung up before the server finished. nginx logs it when a user navigates away or a mobile connection drops mid-request — a strong signal your endpoint is too slow. | |
| Bandwidth Limit Exceeded | The account has used up its bandwidth allocation. Hosting-panel convention (cPanel/WHM). | |
| Site Is Overloaded | The site is overloaded and cannot handle the request. Qualys and some CDNs use it as a distinct “capacity” signal from 503. | |
| Network Read Timeout Error | A network read timed out. Informal Microsoft/Azure convention alongside 599. | |
| Network Connect Timeout Error | A network connection attempt timed out. Informal; used by proxies and load balancers to report a connect-level failure. |
Nothing matches that. Try a number like 418, or a word like timeout.
The five classes, and why they exist
The first digit of a status code tells you who needs to act. 1xx means the request is still in flight. 2xx means it worked. 3xx means look somewhere else. 4xx means the request is wrong — retrying it unchanged will fail the same way. 5xx means the server failed on a request that looked fine, so a retry with backoff is reasonable.
That 4xx/5xx split is the single most useful thing to internalise. It tells a client whether to give up or back off, tells a monitoring system whether to page someone, and tells you whether to look at your own code or at the dependency behind it.
Codes that get confused for each other
401vs403— 401 means “I do not know who you are”; 403 means “I know exactly who you are, and no”. Sending the same credentials again fixes 401, never 403.400vs422— 400 is a malformed request; 422 is well-formed but semantically rejected. Validation errors on a JSON API belong in 422.301vs302vs307vs308— the first pair are permanent/temporary with historically fuzzy method handling; 307 and 308 are the method-preserving versions of 302 and 301.502vs503vs504— 502 is a broken upstream response, 503 is the server deliberately refusing work, 504 is an upstream that never answered.404vs410— 404 means “not here (maybe never was)”; 410 says “it was here and is gone for good”, which search engines act on immediately.
Which ones are safe to retry
Only retry a 5xx — and only when the request is idempotent (GET, PUT, DELETE, or a POST
you have made idempotent with an idempotency key). Never retry a 4xx without changing
the request. On 429 and 503, read the Retry-After header and
wait at least that long; hammering sooner usually extends the ban.
FAQ
Why does 502 show up so often behind nginx or a CDN?
Because the gateway is fine but the process behind it is not. Either the app crashed, it is listening on a different port or socket, or it is still booting. Check the upstream first — the gateway is almost never the culprit.
Is 418 I'm a Teapot real?
It is registered, it came from a 1998 April Fools' RFC, and plenty of APIs still return it for a deliberately nonsensical request. It is a fine way to test how a client handles a code it has never seen.
Do status codes affect SEO?
Yes, directly. 301 passes ranking signals to the new URL, 302 does not, 404 makes a page drop out of the index gradually, and 410 drops it faster. Returning 200 with a “not found” page — a soft 404 — is the worst of both worlds.
What is a soft 404?
A response with status 200 whose body says the page does not exist. Search engines dislike it and API clients mistake it for success. Always match the status to the outcome.