Look up any HTTP status code: what it means, when servers send it and which specification defines it. Search by number or keyword, filter by class, and link straight to a code.
The server received the request headers and the client may send the body. Seen when a client sends “Expect: 100-continue” before uploading a large body.
The resource has moved permanently to the URL in the Location header. Browsers and search engines update their links; some clients change POST to GET when following it.
The resource is temporarily at another URL given in the Location header. Common after logins and for short-term redirects; browsers usually follow it with GET.
The client should fetch the result from another URL with GET. Used after a form POST to redirect to a confirmation page (the Post/Redirect/Get pattern).
The resource is temporarily at another URL and the client must repeat the request with the same method and body. Also used by browsers for internal HSTS redirects to HTTPS.
The resource has moved permanently and the client must use the same method and body at the new URL. The permanent counterpart of 307, safe for redirecting POST requests.
The request lacks valid authentication credentials. Despite the name, it means “unauthenticated”; the server sends a WWW-Authenticate header describing how to log in.
The server understood the request but refuses it, and logging in again will not help. Seen when permissions are missing, a directory listing is disabled or a firewall blocks the client.
The resource exists but does not support the HTTP method used, such as POST to a read-only URL. The response lists the allowed methods in the Allow header.
The URL is longer than the server will process. Usually caused by a form sending too much data with GET or a redirect loop that keeps appending parameters.
An April Fools' joke from the 1998 Hyper Text Coffee Pot Control Protocol: a teapot refusing to brew coffee. HTTP reserves the code as unused, but some servers return it as an Easter egg or to reject unwanted bots.
Not a standard code. nginx uses it internally to close the connection without sending any response, often to drop unwanted traffic; clients never actually receive it.
Not a standard code. nginx logs it when the client closed the connection before the server responded, for example a user cancelling a slow page or a client-side timeout.
The server hit an unexpected error and could not complete the request. A generic error from a bug, crash or misconfiguration; the server logs have the details.
A gateway or proxy received an invalid response from the upstream server. Common when the application behind nginx or a load balancer has crashed or is restarting.
The server is temporarily unable to handle the request because it is overloaded or down for maintenance. A Retry-After header may say when to try again.
Not a standard code. Cloudflare returns it when the origin server refused the connection, usually because the web server is down or blocking Cloudflare's IP addresses.
Not a standard code. Cloudflare returns it when it connected to the origin but did not receive an HTTP response within its timeout (100 seconds by default).
Not a standard code. Cloudflare returns it when the origin's SSL certificate is invalid and the Full (strict) SSL mode is enabled.
Defined in Cloudflare
How to use it
Type a code number (such as 404 or just 5 for all server errors) or a keyword such as “redirect” or “timeout”.
Narrow the list with the class filter: informational, success, redirection, client error or server error.
Use “Copy link” on any code to share a direct link to it, for example in a bug report.
How it works
Every HTTP response starts with a three-digit status code. The first digit sets the class: 1xx informational responses, 2xx success, 3xx redirection, 4xx errors caused by the request, and 5xx errors on the server side. Clients that do not recognise a specific code treat it like the x00 code of its class, so an unknown 4xx code is handled like 400.
The core codes are defined in RFC 9110 (HTTP Semantics, 2022), which replaced the older RFC 7231. Others come from extensions: WebDAV (RFC 4918), RFC 6585 for 428, 429, 431 and 511, RFC 7725 for 451, and RFC 8470 for 425. RFC 9110 also renamed two codes: 413 is now “Content Too Large” and 422 “Unprocessable Content”, which you may still see under their old names “Payload Too Large” and “Unprocessable Entity”.
Some codes you meet in logs are not standards at all. nginx uses 444 and 494–499 internally (499 shows a client that gave up waiting), and Cloudflare returns 520–526 when it cannot get a proper answer from the origin server. These are marked “Non-standard” in the list. The reason phrases (such as “Not Found”) are shown in English as written in the specifications; HTTP/2 and HTTP/3 send only the number.
Examples
301 or 308 when moving a site
Both are permanent. Use 301 for ordinary page moves; use 308 when clients must repeat POST or PUT requests to the new URL, because some clients change POST to GET after a 301.
401 versus 403
An API returns 401 when no token or an expired token is sent, so the client should log in. It returns 403 when the token is valid but the user lacks permission, so logging in again will not help.
Diagnosing a 502 behind nginx
A 502 Bad Gateway from nginx means the application behind it did not answer properly. Check whether the app process is running and what it logged; 504 instead means it answered too slowly.
Frequently asked questions
What is the difference between 404 and 410?
404 means the server cannot find the resource and says nothing about the future. 410 says the resource was deliberately removed and will not return, which helps search engines drop the URL sooner.
Should a validation error return 400 or 422?
Both are used. 400 fits requests the server cannot parse, such as broken JSON. 422 fits requests that parse correctly but contain invalid values, such as an email field without an @.
Is 418 I'm a teapot a real status code?
It comes from an April Fools' RFC from 1998. RFC 9110 reserves 418 as unused so it is not assigned to anything else, and a few servers return it as a joke, but it has no standard meaning.
Where does 499 come from?
499 is nginx-specific. It appears in nginx logs when the client closes the connection before the server sends a response. The client never receives a 499; it usually points to slow responses or client-side timeouts.
Do search engines treat 302 like 301?
A 302 signals a temporary move, so search engines usually keep the original URL indexed at first. If a 302 stays in place for a long time, Google may treat it like a permanent redirect. Use 301 or 308 for permanent moves.
Privacy
The list is part of the page. Searching and filtering happen in your browser; your search terms are not sent anywhere or included in analytics.