HTTP status code reference

The initial part of the request has been received and the client should continue with the rest of it.

The server is switching protocols as requested by the client, e.g. to WebSocket.

The server has received and is processing the request, but no response is available yet (WebDAV).

Used to return some response headers before the final HTTP message, e.g. for preloading resources.

The request succeeded. The meaning depends on the method: GET returns a resource, POST returns the result of an action.

The request succeeded and a new resource was created as a result, usually after a POST or PUT.

The request has been received but not yet acted upon. Processing may not have started.

The returned metadata is not exactly the same as from the origin server, but from a local or third-party copy.

The request succeeded but there is no content to send back, and the client should keep its current view.

Tells the client to reset the document view, e.g. clear a form after a successful submit.

Used when the client requested a range of a resource with a Range header.

A non-standard, informal code some Apache/PHP-FPM setups return to indicate an error occurred but was handled gracefully - a reference to the "this is fine" meme.

The request has more than one possible response, and the client should choose one.

The resource has been permanently moved to a new URL, given in the Location header.

The resource has been temporarily moved to a different URL. The original URL should still be used for future requests.

The response can be found at another URL using a GET request, commonly used after a POST.

The resource has not changed since the version specified by the request headers, so no body is sent.

Like 302, but the method and body of the original request must be reused for the new request.

Like 301, but the method and body of the original request must be reused for the new request.

The server cannot process the request due to a client error, such as malformed syntax.

The client must authenticate itself to get the requested response.

Reserved for future use, occasionally seen for API usage limits or paywalls.

The client does not have access rights to the content, even though it may be authenticated.

The server cannot find the requested resource. The URL may be wrong or the resource no longer exists.

The request method is known by the server but is not supported for this resource.

The server cannot produce a response matching the list of acceptable values in the request headers.

Similar to 401, but authentication is needed with a proxy first.

The server timed out waiting for the request from the client.

The request conflicts with the current state of the target resource.

The requested resource is permanently gone and will not be available again.

The server refuses to accept the request without a defined Content-Length header.

One of the conditions in the request headers is not met by the server.

The request body is larger than the server is willing or able to process.

The URL requested by the client is longer than the server is willing to interpret.

The media format of the requested data is not supported by the server.

The range specified by the Range header cannot be fulfilled.

The expectation given in the Expect request header could not be met.

A joke response code from an April Fools RFC, sometimes used by servers that refuse to brew coffee.

The request was well-formed but contains semantic errors, e.g. failed validation.

The server is unwilling to risk processing a request that might be replayed.

The server refuses to perform the request using the current protocol and wants an upgrade.

The origin server requires the request to be conditional, to avoid lost update conflicts.

The client has sent too many requests in a given time window (rate limiting).

(Shopify) A non-standard code Shopify returns when a request is blocked by its security systems, often due to suspicious or automated traffic.

The server is unwilling to process the request because its header fields are too large.

(NGINX) The server closes the connection without sending any response, commonly used to silently drop malformed or malicious requests.

The resource is unavailable due to a legal demand, such as government-mandated censorship.

(AWS ELB) The client closed the connection to the load balancer before the idle timeout elapsed, so no response header was received.

(AWS ELB) The load balancer received an X-Forwarded-For header containing more IP addresses than it allows.

(AWS ELB) The client and the registered target are using incompatible protocol versions, so the request cannot be forwarded.

(NGINX) The request header sent by the client is larger than the buffer the server is configured to accept.

(NGINX) The client presented an invalid SSL certificate during mutual TLS authentication.

(NGINX) The client did not present the SSL certificate required by the server during mutual TLS authentication.

(NGINX) A plain HTTP request was sent to a port that only accepts HTTPS (TLS) connections.

(NGINX) The client closed the connection before the server could finish sending a response.

A generic error indicating the server encountered an unexpected condition it could not handle.

The request method is not supported by the server and cannot be handled.

The server, acting as a gateway or proxy, received an invalid response from the upstream server.

The server is not ready to handle the request, often due to maintenance or overload.

The server, acting as a gateway or proxy, did not get a response in time from the upstream server.

The HTTP version used in the request is not supported by the server.

The server is unable to store the representation needed to complete the request (WebDAV).

The server detected an infinite loop while processing the request (WebDAV).

The client needs to authenticate to gain network access, e.g. a captive portal.

(Cloudflare) The origin server returned an empty, unexpected, or otherwise unrecognised response that doesn't match any other 5xx code.

(Cloudflare) The origin server refused the connection from Cloudflare, usually because it is offline.

(Cloudflare) Cloudflare could not negotiate a TCP handshake with the origin server in time.

(Cloudflare) Cloudflare could not reach the origin server, often due to DNS or routing problems.

(Cloudflare) Cloudflare connected to the origin server but the connection timed out before a response was returned.

(Cloudflare) The SSL/TLS handshake between Cloudflare and the origin server failed.

(Cloudflare) The origin server's SSL certificate is invalid, expired, or does not match, and strict SSL validation is enabled.

(Cloudflare) The connection between Cloudflare and the origin's Railgun server was interrupted (a now-legacy Cloudflare feature).

(Cloudflare) Cloudflare could not resolve the DNS record for the origin server, usually paired with Cloudflare error 1016.

(Shopify) A non-standard code some Shopify endpoints return when a feature or storefront is temporarily unavailable.

(AWS ELB) The load balancer's built-in authentication (e.g. for OIDC or Cognito) rejected the request.

(Informal convention) Used by some proxies to indicate the connection to the upstream server timed out while reading a response.

(Informal convention) Used by some HTTP clients and proxies to indicate the connection to the upstream server timed out before it could even be established.

(AWS ELB) Recorded in load balancer access logs when no status code could be determined, e.g. the client closed the connection before a response, or a health check failed.

(Shopify) A non-standard status code used internally by some Shopify infrastructure; not part of any official HTTP specification.