HTTP Status Codes

A searchable reference of HTTP status codes from 100 to 511, with what each means, when servers send it and how to handle it.

Runs in your browser. Everything you enter stays on your device. Nothing is sent to a server.

1xx Informational

100ContinueRFC 9110: The server received the request headers; the client should send the body.; Used with the Expect: 100-continue header so large uploads aren't sent to a server that will reject them.
101Switching ProtocolsRFC 9110: The server is switching to the protocol the client requested via the Upgrade header.; Most commonly seen when a connection is upgraded to WebSocket.
103Early HintsRFC 8297: Preliminary headers sent before the final response so the browser can start preloading resources.

2xx Success

200OKRFC 9110: The request succeeded.; The meaning depends on the method: GET returns the resource, POST returns the result of the action.
201CreatedRFC 9110: The request succeeded and a new resource was created.; Should include a Location header pointing to the new resource. Typical response to a successful POST.
202AcceptedRFC 9110: The request was accepted for processing, but processing isn't finished.; Used for asynchronous jobs; the response often includes a URL to check status.
203Non-Authoritative InformationRFC 9110: The response was modified by a transforming proxy.
204No ContentRFC 9110: The request succeeded and there is no body to return.; Common for DELETE and for PUT/PATCH when the client doesn't need the updated resource.
205Reset ContentRFC 9110: The client should reset the document view, for example clear a form.
206Partial ContentRFC 9110: The server is returning only part of the resource, as requested with a Range header.; Used for resumable downloads and video streaming.
207Multi-StatusRFC 4918: Multiple status codes for multiple operations (WebDAV).

3xx Redirection

300Multiple ChoicesRFC 9110: There are several possible responses; the client should choose one.
301Moved PermanentlyRFC 9110: The resource has a new permanent URL, given in the Location header.; Search engines transfer ranking to the new URL. Browsers may change POST to GET when following it — use 308 to keep the method.
302FoundRFC 9110: The resource is temporarily at another URL.; Browsers usually change POST to GET when following it. Use 307 to preserve the method.
303See OtherRFC 9110: Get the result from another URL using GET.; The standard response after a form POST (Post/Redirect/Get pattern).
304Not ModifiedRFC 9110: The cached copy is still valid; no body is sent.; Returned for conditional requests using If-None-Match (ETag) or If-Modified-Since.
307Temporary RedirectRFC 9110: Temporarily redirect, keeping the same method and body.
308Permanent RedirectRFC 9110: Permanently redirect, keeping the same method and body.

4xx Client error

400Bad RequestRFC 9110: The server can't process the request because it's malformed.; Invalid JSON, missing required fields or invalid parameters. The response body should explain what's wrong.
401UnauthorizedRFC 9110: Authentication is required or has failed.; Despite the name, it means unauthenticated. The client should log in or send valid credentials. Includes a WWW-Authenticate header.
402Payment RequiredRFC 9110: Reserved for future use; some APIs use it for billing problems.
403ForbiddenRFC 9110: The server understood the request but refuses to authorise it.; The client is known but lacks permission. Logging in again won't help.
404Not FoundRFC 9110: The server can't find the requested resource.; Also used to hide the existence of a resource from unauthorised users.
405Method Not AllowedRFC 9110: The method isn't supported for this resource, e.g. DELETE on a read-only endpoint.; Must include an Allow header listing supported methods.
406Not AcceptableRFC 9110: The server can't produce a response matching the Accept headers.
407Proxy Authentication RequiredRFC 9110: The client must authenticate with a proxy.
408Request TimeoutRFC 9110: The server timed out waiting for the request.
409ConflictRFC 9110: The request conflicts with the current state of the resource.; Examples: editing a stale version, or creating a user whose email already exists.
410GoneRFC 9110: The resource was deliberately removed and won't come back.; Tells search engines to drop the URL faster than a 404.
411Length RequiredRFC 9110: The request needs a Content-Length header.
412Precondition FailedRFC 9110: A condition in the request headers (such as If-Match) wasn't met.; Used for optimistic concurrency control.
413Content Too LargeRFC 9110: The request body is larger than the server allows.; Formerly called “Payload Too Large”. Seen when uploading files above a limit.
414URI Too LongRFC 9110: The URL is longer than the server will process.
415Unsupported Media TypeRFC 9110: The request body's format isn't supported.; Often a missing or wrong Content-Type header, e.g. sending form data to a JSON endpoint.
416Range Not SatisfiableRFC 9110: The requested byte range is outside the resource.
417Expectation FailedRFC 9110: The server can't meet the Expect request header.
418I'm a teapotRFC 2324 (non-standard): An April Fools' joke from the Hyper Text Coffee Pot Control Protocol.; Not part of HTTP proper, but reserved so it won't be reused, and some sites use it playfully.
421Misdirected RequestRFC 9110: The request was sent to a server that can't respond for this host.
422Unprocessable ContentRFC 9110: The request is well-formed but contains invalid data.; Widely used by APIs for validation errors, e.g. a malformed email address.
423LockedRFC 4918: The resource is locked (WebDAV).
425Too EarlyRFC 8470: The server won't risk processing a request that might be replayed.
426Upgrade RequiredRFC 9110: The client must switch to a different protocol.
428Precondition RequiredRFC 6585: The server requires conditional requests to prevent lost updates.
429Too Many RequestsRFC 6585: The client has sent too many requests in a given time (rate limiting).; Check the Retry-After header and back off before retrying.
431Request Header Fields Too LargeRFC 6585: The headers are too large — often because of oversized cookies.
451Unavailable For Legal ReasonsRFC 7725: Access is blocked for legal reasons, such as a court order.

5xx Server error

500Internal Server ErrorRFC 9110: The server hit an unexpected error.; A generic catch-all. The cause is in the server logs, not the request.
501Not ImplementedRFC 9110: The server doesn't support the functionality required.
502Bad GatewayRFC 9110: A proxy or gateway got an invalid response from the upstream server.; Common when an app server has crashed behind a load balancer or reverse proxy.
503Service UnavailableRFC 9110: The server is temporarily overloaded or down for maintenance.; May include a Retry-After header. Search engines treat it as temporary.
504Gateway TimeoutRFC 9110: A proxy or gateway didn't get a response from the upstream server in time.
505HTTP Version Not SupportedRFC 9110: The server doesn't support the HTTP version used.
507Insufficient StorageRFC 4918: The server can't store what's needed to complete the request (WebDAV).
508Loop DetectedRFC 5842: The server found an infinite loop while processing (WebDAV).
511Network Authentication RequiredRFC 6585: The client must authenticate to gain network access, e.g. a Wi-Fi captive portal.

How to use the HTTP Status Codes

Search by number (e.g. 404) or by meaning (e.g. “timeout”).
Read what the code means and when servers send it.

The five classes

1xx — informational; the request is continuing.
2xx — success.
3xx — redirection; the client must take another step.
4xx — client error; the request needs to change before it can succeed.
5xx — server error; the request may be fine, but the server failed.

Codes that are often confused

401 vs 403: 401 means “who are you?” (not logged in); 403 means “I know who you are, and you can't do this”.
301 vs 302 vs 307 vs 308: 301/308 are permanent, 302/307 temporary; 307/308 guarantee the method (e.g. POST) is kept.
400 vs 422: 400 for malformed requests; 422 for well-formed requests with invalid values.
502 vs 503 vs 504: bad upstream response, server unavailable, and upstream timeout.

Frequently asked questions

Which codes matter for SEO?

Use 301 or 308 for permanent moves so rankings transfer, 404 or 410 for removed pages, and 503 with Retry-After for planned maintenance so search engines don't drop pages.

Where do these definitions come from?

Most are defined in RFC 9110 (HTTP Semantics, 2022). Others come from the RFC noted on each card.

Is what I enter stored or sent anywhere?

No. Calculations and processing happen in your browser. Nothing you type is sent to our servers. Some tools remember your last input in this browser's local storage for convenience; you can clear it at any time.