HTTP status codes
| What a status code is | |
| See the code of a page | |
| 1xx: Informational | |
| 2xx: Success | |
| 3xx: Redirection | |
| 4xx: Client error | |
| 5xx: Server error | |
| Codes outside the standard |
What a status code is
Every HTTP answer starts with a status line: the protocol version, a three-digit code and a short phrase for people, for example HTTP/1.1 404 Not Found. The first digit is the class. A client that does not know a code treats it like the x00 code of its class, so an unknown 499 is handled like 400. The codes and their names are defined in RFC 9110, HTTP Semantics, and in a few RFCs for extensions; IANA keeps the list.
See the code of a page
curl with -I asks for the headers only. Four answers of this site on a local test server:
curl -sI http://127.0.0.1:8080/i/nginx/install/ | head -1
HTTP/1.1 200 OK
curl -sI http://127.0.0.1:8080/linux/centos/iftop.php | grep -E '^(HTTP|Location)'
HTTP/1.1 301 Moved Permanently Location: http://127.0.0.1:8080/linux/centos/network/iftop.php
curl -sI http://127.0.0.1:8080/no-such-page/ | head -1
HTTP/1.1 404 Not Found
curl -sI http://127.0.0.1:8080/.htaccess | head -1
HTTP/1.1 403 Forbidden
In a browser, open the developer tools (F12), tab Network, and reload the page: the column Status shows the code of every file.
1xx: Informational
An interim answer: the request goes on, and the final answer follows.
| Code | Name | Meaning |
|---|---|---|
| 100 | Continue | The headers are fine, send the body. A client that sent Expect: 100-continue waits for it before uploading a large body. |
| 101 | Switching Protocols | The server switches to the protocol from the Upgrade header, for example WebSocket. |
| 102 | Processing | WebDAV: still working, do not time out. Deprecated. |
| 103 | Early Hints | Headers sent early, usually Link headers, so the browser can start loading styles and scripts while the page is being built. |
2xx: Success
| Code | Name | Meaning |
|---|---|---|
| 200 | OK | The request succeeded; the body has the result. |
| 201 | Created | A new resource was created; its address is in Location. A typical answer to POST, see PUT vs POST. |
| 202 | Accepted | Accepted for processing that is not finished yet. |
| 203 | Non-Authoritative Information | A proxy changed the answer of the origin server. |
| 204 | No Content | Done, and there is nothing to send back. |
| 205 | Reset Content | Done; the client should clear the form. |
| 206 | Partial Content | Only the requested byte range, see Content-Range. Used to resume downloads and to stream video. |
| 207 | Multi-Status | WebDAV: several results in one XML body. |
| 208 | Already Reported | WebDAV: this member was already listed earlier in the answer. |
| 226 | IM Used | The answer is a delta to an earlier version (RFC 3229). |
3xx: Redirection
The client has to make another request, usually to the address in Location. How to set redirects up: Redirects.
| Code | Name | Meaning |
|---|---|---|
| 300 | Multiple Choices | Several versions exist, for example in different languages; the client may choose. |
| 301 | Moved Permanently | The resource moved for good. Browsers may change a POST to GET on the way. |
| 302 | Found | Temporarily elsewhere. Called Moved Temporarily in HTTP/1.0. Browsers may change a POST to GET. |
| 303 | See Other | Get the result from another address with GET, for example after a form was sent. |
| 304 | Not Modified | The copy in the cache is still current; no body. An answer to If-Modified-Since or If-None-Match. |
| 305 | Use Proxy | Deprecated; not followed by browsers for security reasons. |
| 306 | (Unused) | Used in an early draft, now reserved. |
| 307 | Temporary Redirect | Temporarily elsewhere; repeat the same method with the same body. |
| 308 | Permanent Redirect | Moved for good; repeat the same method with the same body. |
4xx: Client error
Something is wrong with the request. Repeating it unchanged gives the same error.
| Code | Name | Meaning |
|---|---|---|
| 400 | Bad Request | The server cannot read the request: bad syntax, an invalid header, broken JSON. |
| 401 | Unauthorized | Authentication is missing or wrong; the WWW-Authenticate header says how to log in. |
| 402 | Payment Required | Reserved for future use; some APIs use it for exhausted quotas. |
| 403 | Forbidden | The server understood and refuses: no rights, a blocked address, a protected file such as .htaccess, or a folder without an index page and without directory listing. |
| 404 | Not Found | Nothing at this address, or the server does not want to say that it exists. |
| 405 | Method Not Allowed | The resource exists but not for this method; Allow lists the methods it takes. |
| 406 | Not Acceptable | No version matches the Accept headers of the request. |
| 407 | Proxy Authentication Required | Like 401, but for a proxy. |
| 408 | Request Timeout | The client took too long to send the request. |
| 409 | Conflict | The request conflicts with the current state, for example an edit of an outdated version. |
| 410 | Gone | Removed for good, with no new address. Search engines drop it faster than a 404. |
| 411 | Length Required | Content-Length is missing. |
| 412 | Precondition Failed | A condition such as If-Match is false. |
| 413 | Content Too Large | The body is larger than the server accepts, for example a file upload. Formerly Payload Too Large. |
| 414 | URI Too Long | The address is too long, often a GET with a huge query string. |
| 415 | Unsupported Media Type | The server cannot process the Content-Type of the body. |
| 416 | Range Not Satisfiable | The requested byte range is outside the file. |
| 417 | Expectation Failed | The Expect header cannot be met. |
| 418 | (Unused) | Reserved. Known as "I'm a teapot" from an April Fools' RFC. |
| 421 | Misdirected Request | The request reached a server that cannot answer for this host. |
| 422 | Unprocessable Content | The syntax is fine but the data is invalid, for example a failed form validation. Formerly Unprocessable Entity. |
| 423 | Locked | WebDAV: the resource is locked. |
| 424 | Failed Dependency | WebDAV: an earlier part of the request failed. |
| 425 | Too Early | The server will not risk processing a request that may be replayed (TLS early data). |
| 426 | Upgrade Required | Switch to the protocol named in Upgrade. |
| 428 | Precondition Required | The request must be conditional, to avoid lost updates. |
| 429 | Too Many Requests | Rate limit hit; Retry-After says when to try again. |
| 431 | Request Header Fields Too Large | One header or all of them together are too large, often too many cookies. |
| 451 | Unavailable For Legal Reasons | Blocked for legal reasons, for example a court order. |
5xx: Server error
The request may be fine; the server failed. Its error log has the cause.
| Code | Name | Meaning |
|---|---|---|
| 500 | Internal Server Error | Something broke on the server: a PHP fatal error, a wrong .htaccess line. |
| 501 | Not Implemented | The server does not support the method at all. |
| 502 | Bad Gateway | A proxy got no valid answer from the server behind it, for example Nginx when PHP-FPM or php-cgi is not running. |
| 503 | Service Unavailable | Overloaded or under maintenance; Retry-After may say for how long. |
| 504 | Gateway Timeout | A proxy waited too long for the server behind it. |
| 505 | HTTP Version Not Supported | The server does not support the HTTP version of the request. |
| 506 | Variant Also Negotiates | A configuration error in content negotiation. |
| 507 | Insufficient Storage | WebDAV: no space left to store the result. |
| 508 | Loop Detected | WebDAV: an infinite loop while processing. |
| 510 | Not Extended | An extension the request needs is missing. Historic. |
| 511 | Network Authentication Required | Log in to the network first, for example on a hotel or airport Wi-Fi page. |
Codes outside the standard
Some programs and services use codes of their own. You meet them in logs and in error pages:
| Code | Where | Meaning |
|---|---|---|
| 419 | Laravel | Page Expired: the CSRF token of a form is missing or too old. |
| 449 | Microsoft IIS | Retry With: the request lacks information. |
| 499 | Nginx | Client Closed Request: the client closed the connection before the answer, written only to the log. |
| 509 | cPanel, Apache modules | Bandwidth Limit Exceeded: the site used up its traffic. |
| 520 | Cloudflare | Web Server Returned an Unknown Error. |
| 521 | Cloudflare | Web Server Is Down: the origin refused the connection. |
| 522 | Cloudflare | Connection Timed Out to the origin. |
| 523 | Cloudflare | Origin Is Unreachable. |
| 524 | Cloudflare | A Timeout Occurred: the origin accepted the connection but answered too late. |
| 525 | Cloudflare | SSL Handshake Failed with the origin. |
| 526 | Cloudflare | Invalid SSL Certificate on the origin. |
Microsoft IIS also writes sub-codes to its logs after a dot, such as 404.3; they never appear in the answer itself.
Article authors: Andrei Olegovich, Klavdiya Kondakova