HTTP status codes

100 Continue Standard

Interim response: the server will accept the body the client announced with Expect: 100-continue.

Common causes Clients such as curl send Expect: 100-continue before large uploads.

RFC 9110 15.2.1

101 Switching Protocols Standard

The server switches to the protocol named in the Upgrade header.

Common causes Opening a websocket connection (Upgrade: websocket).

nginx

Proxying websockets needs proxy_http_version 1.1 and the Upgrade / Connection headers passed on.

RFC 9110 15.2.2

102 Processing Standard

Interim WebDAV response: the request is still being processed.

Common causes Long-running WebDAV operations; rarely seen today.

RFC 2518

103 Early Hints Standard

Interim response carrying Link headers so the browser can preload resources before the final response.

Common causes CDNs and servers that send preload hints.

nginx

Controlled by the early_hints directive.

RFC 8297

104 Upload Resumption Supported (TEMPORARY - registered 2024-11-13, extension registered 2025-09-15, expires 2026-11-13) Standard

Temporary registration for resumable uploads: the server supports resuming this upload.

Common causes Servers implementing the resumable-upload draft.

draft-ietf-httpbis-resumable-upload-05

200 OK Standard

The request succeeded.

HAProxy

Stats page and replies to monitoring requests.

RFC 9110 15.3.1

201 Created Standard

A new resource was created, usually named in the Location header.

Common causes POST or PUT to an API that creates something.

RFC 9110 15.3.2

202 Accepted Standard

Accepted for processing, but not finished yet.

Common causes Asynchronous jobs and queues.

RFC 9110 15.3.3

203 Non-Authoritative Information Standard

Success, but a transforming proxy changed the content from the origin’s 200 response.

Common causes Proxies that rewrite responses.

RFC 9110 15.3.4

204 No Content Standard

Success with no body.

Common causes DELETE or PUT APIs, CORS preflight (OPTIONS) replies.

RFC 9110 15.3.5

205 Reset Content Standard

Success; the client should reset the document view (for example clear a form).

Common causes Rare.

RFC 9110 15.3.6

206 Partial Content Standard

Only the byte range asked for with Range is sent.

Common causes Video streaming, resumed downloads (curl -C -).

RFC 9110 15.3.7

207 Multi-Status Standard

WebDAV: the body holds a separate status for each of several resources.

Common causes WebDAV clients (PROPFIND).

RFC 4918

208 Already Reported Standard

WebDAV: members already listed earlier in the same multi-status response are not repeated.

Common causes WebDAV bindings.

RFC 5842

226 IM Used Standard

The response is a delta (instance manipulation) of the current resource.

Common causes Delta encoding; rare.

RFC 3229

300 Multiple Choices Standard

Several representations are available; the client may choose.

Common causes Rare.

RFC 9110 15.4.1

301 Moved Permanently Standard

Permanent redirect to the URL in Location. Clients may change POST to GET when following.

Common causes HTTP → HTTPS, www → bare domain, moved pages.

nginx

return 301 … or rewrite … permanent.

HAProxy

redirect with code 301.

RFC 9110 15.4.2

302 Found Standard

Temporary redirect to Location. Clients may change POST to GET when following.

Common causes Login redirects, temporary moves.

nginx

return 302 … or rewrite … redirect.

HAProxy

redirect with code 302 (the default).

RFC 9110 15.4.3

303 See Other Standard

Fetch the result from Location with GET.

Common causes Post/redirect/get after a form submission.

HAProxy

redirect with code 303.

RFC 9110 15.4.4

304 Not Modified Standard

The cached copy is still valid; no body is sent.

Common causes Conditional requests with If-None-Match or If-Modified-Since.

RFC 9110 15.4.5

305 Use Proxy Standard

Deprecated: access through a proxy.

Common causes Not used.

RFC 9110 15.4.6

306 (Unused) Standard

Reserved; was used in an earlier draft and is no longer used.

RFC 9110 15.4.7

307 Temporary Redirect Standard

Temporary redirect that keeps the method and body.

Common causes HSTS internal redirects in browsers, API moves.

HAProxy

redirect with code 307.

RFC 9110 15.4.8

308 Permanent Redirect Standard

Permanent redirect that keeps the method and body.

Common causes Moved API endpoints.

HAProxy

redirect with code 308.

RFC 9110 15.4.9

400 Bad Request Standard

The server cannot process the request because it is malformed.

Common causes Broken syntax or JSON, invalid headers, oversized headers or cookies.

nginx

A header line larger than one large_client_header_buffers buffer (page “Request Header Or Cookie Too Large”, internally 494), plain HTTP sent to an HTTPS port (internally 497), client-certificate errors (495 · 496).

HAProxy

Invalid or too large request.

RFC 9110 15.5.1

401 Unauthorized Standard

Authentication is required or failed; the response carries WWW-Authenticate.

Common causes Missing or wrong credentials, expired tokens.

nginx

auth_basic without valid credentials.

HAProxy

Authentication required (for example the stats page).

RFC 9110 15.5.2

402 Payment Required Standard

Reserved for future use.

Common causes Some APIs use it for billing limits.

RFC 9110 15.5.3

403 Forbidden Standard

The server understood the request but refuses it.

Common causes Access rules, file permissions, blocked by a firewall or WAF.

nginx

deny rules, files nginx cannot read, or a directory without an index file and autoindex off.

HAProxy

An http-request deny rule.

Cloudflare

WAF rules, security features, DDoS protection and most 1xxx errors (for example 1020 Access denied) return 403.

RFC 9110 15.5.4

404 Not Found Standard

The resource does not exist (or the server will not say it does).

Common causes Wrong path, deleted page, wrong root or routing.

HAProxy

The requested resource could not be found.

RFC 9110 15.5.5

405 Method Not Allowed Standard

The method is not allowed for this resource; the response lists allowed ones in Allow.

Common causes POST to a static file, wrong verb for an API route.

RFC 9110 15.5.6

406 Not Acceptable Standard

No representation matches the Accept* headers.

Common causes Strict content negotiation.

RFC 9110 15.5.7

407 Proxy Authentication Required Standard

A proxy needs credentials (Proxy-Authenticate).

Common causes Corporate proxies.

RFC 9110 15.5.8

408 Request Timeout Standard

The server gave up waiting for the complete request.

Common causes Slow or stalled clients, idle keep-alive connections.

nginx

client_header_timeout or client_body_timeout expired.

HAProxy

The request timeout struck before the request was complete.

Cloudflare

Usually proxied from the origin; Cloudflare also returns it when client requests exceed its internal timeouts.

RFC 9110 15.5.9 · Manual: Read a HAProxy log line — status code and termination state

409 Conflict Standard

The request conflicts with the current state of the resource.

Common causes Edit conflicts, duplicate keys, version mismatches.

RFC 9110 15.5.10

410 Gone Standard

The resource is gone permanently.

Common causes Deliberately removed pages or API versions.

HAProxy

The resource is no longer available and will not be again.

RFC 9110 15.5.11

411 Length Required Standard

The server requires a Content-Length header.

Common causes Bodies sent without a length.

RFC 9110 15.5.12

412 Precondition Failed Standard

A condition in If-Match / If-Unmodified-Since was false.

Common causes Optimistic locking with ETags.

RFC 9110 15.5.13

413 Content Too Large Standard

The request body is larger than the server accepts.

Common causes Big uploads or JSON bodies over a size limit.

nginx

The body exceeds client_max_body_size (default 1m).

HAProxy

An HTTP/1.0 GET/HEAD/DELETE request carries a payload (see h1-accept-payload-with-any-method).

Cloudflare

The upload exceeds the zone’s maximum upload size (100 MB on Free and Pro, 200 MB on Business).

RFC 9110 15.5.14

414 URI Too Long Standard

The request URI is longer than the server accepts.

Common causes Huge query strings, redirect loops that keep appending parameters.

nginx

The request line does not fit in one large_client_header_buffers buffer.

Cloudflare

The URI is longer than 32 KB.

RFC 9110 15.5.15

415 Unsupported Media Type Standard

The body format (Content-Type or Content-Encoding) is not supported.

Common causes Sending JSON without Content-Type: application/json, or form data to a JSON API.

RFC 9110 15.5.16

416 Range Not Satisfiable Standard

The requested byte range is outside the resource.

Common causes Resuming a download of a file that changed or shrank.

RFC 9110 15.5.17

417 Expectation Failed Standard

The server cannot meet the Expect header.

Common causes Expect: 100-continue to servers or proxies that refuse it.

RFC 9110 15.5.18

418 (Unused) Standard

Reserved. Known as “I’m a teapot” from the April Fools’ RFC 2324; RFC 9110 reserves it so it is not assigned.

Common causes Joke or easter-egg responses.

RFC 9110 15.5.19

421 Misdirected Request Standard

The request reached a server that cannot answer for this host.

Common causes Reused HTTP/2 connections for another hostname, SNI and Host mismatch.

Cloudflare

Most often an SNI / Host mismatch; also connection coalescing, Tunnel ingress or custom-domain mismatches.

RFC 9110 15.5.20

422 Unprocessable Content Standard

The syntax is fine but the content cannot be processed.

Common causes Validation errors in APIs.

RFC 9110 15.5.21

423 Locked Standard

WebDAV: the resource is locked.

Common causes Files locked by another client.

RFC 4918

424 Failed Dependency Standard

WebDAV: the action failed because another action it depended on failed.

RFC 4918

425 Too Early Standard

The server will not process a request that might be replayed (TLS early data).

Common causes TLS 1.3 0-RTT requests.

RFC 8470

426 Upgrade Required Standard

The client must switch to another protocol named in Upgrade.

RFC 9110 15.5.22

428 Precondition Required Standard

The server requires a conditional request (If-Match).

Common causes APIs that prevent lost updates.

RFC 6585

429 Too Many Requests Standard

Rate limit exceeded; Retry-After may say when to retry.

Common causes API quotas, bots, retry storms.

nginx

Only if configured: limit_req_status 429 (the default is 503).

Cloudflare

Cloudflare API rate limits (for example 1200 requests per 5 minutes per token).

RFC 6585

431 Request Header Fields Too Large Standard

Header fields are too large.

Common causes Huge cookies or tokens.

nginx

nginx answers 400 (“Request Header Or Cookie Too Large”) instead.

RFC 6585

444 Close connection without response nginx only

nginx closes the connection without sending anything (return 444;). It appears only in nginx’s access log.

Common causes Blocking unwanted hosts or scanners. The client sees an empty reply (curl: “Empty reply from server”).

nginx: ngx_http_rewrite_module · ngx_http_request.h

451 Unavailable For Legal Reasons Standard

Blocked for legal reasons.

Common causes Court orders, regional restrictions.

RFC 7725

494 Request Header Or Cookie Too Large nginx only

nginx’s internal code for a request header larger than one large_client_header_buffers buffer. The client gets 400; error_page 494 can catch it.

Common causes Large cookies or tokens.

nginx: ngx_http_request.h

495 The SSL certificate error nginx only

An error occurred while verifying the client certificate. Sent to the client as 400; usable with error_page.

Common causes Mutual TLS with an invalid or untrusted client certificate.

nginx: ngx_http_ssl_module · ngx_http_special_response.c

496 No required SSL certificate was sent nginx only

The client did not present a required certificate. Sent to the client as 400; usable with error_page.

Common causes ssl_verify_client on without a client certificate.

nginx: ngx_http_ssl_module · ngx_http_special_response.c

497 The plain HTTP request was sent to HTTPS port nginx only

A plain HTTP request was sent to an HTTPS port. Sent to the client as 400; error_page 497 https://$host$request_uri; redirects it.

Common causes http://example.com:443/, wrong port in a proxy or health check.

nginx: ngx_http_ssl_module · ngx_http_special_response.c

499 Client closed request nginx only

The client closed the connection before nginx sent the response header. Logged only; nothing is sent.

Common causes Client or upstream-proxy timeouts shorter than a slow backend, users leaving the page. Cloudflare logs it too.

nginx: ngx_http_request.h

500 Internal Server Error Standard

A generic server-side failure.

Common causes Application exceptions, misconfiguration.

nginx

Configuration problems such as a rewrite or internal redirection cycle.

HAProxy

An unrecoverable internal error (should never happen).

Cloudflare

Has its own Cloudflare error page.

RFC 9110 15.6.1 · Manual: Find which paths return 5xx in an Nginx access log

501 Not Implemented Standard

The server does not support the functionality needed (for example the method).

Common causes Unknown methods or transfer codings.

HAProxy

A client request needs an unsupported feature.

Cloudflare

Has its own Cloudflare error page.

RFC 9110 15.6.2

502 Bad Gateway Standard

A proxy or gateway got an invalid response (or none) from the upstream server.

Common causes Backend down, connection refused, crashed app, oversized upstream headers.

nginx

error.log says why: connect() failed (111: Connection refused), upstream prematurely closed connection, upstream sent too big header, no live upstreams.

HAProxy

The server returned an empty, invalid or incomplete response, or an http-response deny rule matched.

Cloudflare

Cloudflare has a 502/504 error page; a plain page usually comes from the origin.

RFC 9110 15.6.3 · Manual: Tell the cause of an Nginx 502 Bad Gateway from error.log

503 Service Unavailable Standard

The server cannot handle the request right now; Retry-After may say when.

Common causes Overload, maintenance, no healthy backend, rate limiting.

nginx

limit_req and limit_conn reject with 503 by default (limit_req_status).

HAProxy

No server was available, or a monitoring request matched monitor fail.

Cloudflare

Has its own Cloudflare error page.

RFC 9110 15.6.4 · Manual: Read a HAProxy log line — status code and termination state

504 Gateway Timeout Standard

A proxy or gateway did not get a response from the upstream server in time.

Common causes Slow backend queries, long jobs, network problems.

nginx

upstream timed out in error.log — the backend did not answer within proxy_read_timeout (default 60s) or the connect timeout.

HAProxy

The response timeout struck before the server responded.

Cloudflare

Cloudflare has a 502/504 error page (a slow origin after connecting is 524).

RFC 9110 15.6.5 · Manual: Read a HAProxy log line — status code and termination state

505 HTTP Version Not Supported Standard

The HTTP version of the request is not supported.

Common causes Garbage on the connection, non-HTTP clients.

RFC 9110 15.6.6

506 Variant Also Negotiates Standard

Content-negotiation misconfiguration: the chosen variant negotiates again.

Common causes Rare.

RFC 2295

507 Insufficient Storage Standard

WebDAV: not enough storage to complete the request.

Common causes Full disks or quotas on WebDAV servers.

RFC 4918

508 Loop Detected Standard

WebDAV: an infinite loop was detected while processing.

RFC 5842

510 Not Extended (OBSOLETED) Standard

Obsolete: further extensions were required.

Common causes Not used.

RFC 2774 · Status change of HTTP experiments to Historic

511 Network Authentication Required Standard

The client must sign in to the network first.

Common causes Captive portals on public Wi-Fi.

RFC 6585

520 Web server returns an unknown error Cloudflare only

The origin returned an empty, unknown or unexpected response to Cloudflare.

Common causes Origin crashes, firewalls blocking Cloudflare IPs, headers over 128 KB, responses without a status line, HTTP/2 misconfiguration.

Cloudflare docs: Error 520

521 Web server is down Cloudflare only

The origin refused the connection from Cloudflare.

Common causes Web server not running, Cloudflare IPs blocked, nothing listening on 80 (Flexible) or 443 (Full).

Cloudflare docs: Error 521

522 Connection timed out Cloudflare only

Cloudflare timed out contacting the origin: no SYN+ACK within 19 seconds, or no ACK for the request within 90 seconds.

Common causes Firewalls rate-limiting or dropping Cloudflare IPs, overloaded origin, wrong origin IP in DNS.

Cloudflare docs: Error 522

523 Origin is unreachable Cloudflare only

Cloudflare cannot reach the origin — there is no route to its IP.

Common causes Wrong A/AAAA record, routing problems (on AWS, an overly broad route capturing 172.64.0.0/13).

Cloudflare docs: Error 523

524 A timeout occurred Cloudflare only

Cloudflare connected, but the origin sent no HTTP response within the Proxy Read Timeout (125 s by default).

Common causes Long-running requests, overloaded origin.

Cloudflare docs: Error 524

525 SSL handshake failed Cloudflare only

The TLS handshake between Cloudflare and the origin failed (SSL mode Full or Full (strict)).

Common causes No valid certificate, port 443 closed, no SNI support, no shared cipher suites.

Cloudflare docs: Error 525

526 Invalid SSL certificate Cloudflare only

Cloudflare cannot validate the origin certificate (SSL mode Full (strict)).

Common causes Expired, self-signed or wrong-name certificate, incomplete chain.

Cloudflare docs: Error 526

530 Error 530 Cloudflare only

Cloudflare cannot resolve the origin hostname; the body contains a 1xxx error code.

Common causes See the 1xxx error in the page (for example 1016 Origin DNS error).

Cloudflare docs: Error 530