HTTP Status Codes

Look up what each HTTP status code means and when it is sent

Include unofficial codes (nginx, Cloudflare, Laravel)

1xx Informational Interim responses: the request goes on.

100	Continue The headers were accepted: the client can send the body. Answers an Expect: 100-continue header.
101	Switching Protocols The server switches to the protocol named in the Upgrade header, as when a connection becomes a WebSocket.
102	Processing Deprecated The request is still being worked on. Superseded by 103.
103	Early Hints Headers sent ahead, usually Link preloads, while the server prepares the real response.

2xx Success The request was received, understood and accepted.

200	OK The request succeeded. The body holds the result.
201	Created A resource was created. Its URL is in the Location header.
202	Accepted The request was accepted but is not done yet, as with a queued job.
203	Non-Authoritative Information A transforming proxy changed the origin server's response.
204	No Content Success with no body, typical after a DELETE or a PUT.
205	Reset Content Success: the client should reset the form or view that sent the request.
206	Partial Content Part of the resource, answering a Range header: video seeking, resumed downloads.
207	Multi-Status WebDAV Several statuses for several resources, in an XML body.
208	Already Reported WebDAV Members of a binding already listed earlier in a 207 response.
226	IM Used The response is a delta applied to the current instance (RFC 3229). Rarely seen.

3xx Redirection The client must take another step, usually follow the Location header.

300	Multiple Choices Several representations are available and the client should pick one.
301	Moved Permanently The resource moved for good. Browsers and search engines update the URL; a POST may be retried as a GET.
302	Found Temporary redirect. A POST may be retried as a GET: use 307 to keep the method.
303	See Other Fetch another URL with GET, as after a form submission (Post/Redirect/Get).
304	Not Modified The cached copy is still valid, so no body is sent. Answers a conditional request (If-None-Match, If-Modified-Since). Also the name of this site.
305	Use Proxy Deprecated Access the resource through the given proxy. Ignored by browsers for security reasons.
307	Temporary Redirect Like 302, but the method and body must be kept.
308	Permanent Redirect Like 301, but the method and body must be kept.

4xx Client error The request is wrong or not allowed: repeating it as is will fail again.

400	Bad Request The request is malformed: invalid syntax, framing or parameters.
401	Unauthorized Authentication is missing or invalid; the WWW-Authenticate header says how to log in. It really means "unauthenticated".
402	Payment Required Reserved for future use. Some APIs send it for billing problems.
403	Forbidden The server refuses the request. Logging in again will not help.
404	Not Found Nothing exists at this URL, or the server does not want to say it does.
405	Method Not Allowed The resource does not support this method. The Allow header lists those it does.
406	Not Acceptable No representation matches the Accept headers.
407	Proxy Authentication Required Like 401, but for the proxy.
408	Request Timeout The client took too long to send the request; the server closed the connection.
409	Conflict The request conflicts with the resource's current state: edit conflict, duplicate.
410	Gone The resource was removed on purpose and will not come back.
411	Length Required The server requires a Content-Length header.
412	Precondition Failed An If-Match or If-Unmodified-Since condition failed: someone else changed the resource.
413	Content Too Large The body is larger than the server accepts. Formerly "Payload Too Large".
414	URI Too Long The URL is longer than the server accepts, often a GET that should be a POST.
415	Unsupported Media Type The server does not accept this Content-Type.
416	Range Not Satisfiable The Range header asks for bytes outside the resource.
417	Expectation Failed The server cannot meet the Expect header.
418	I'm a teapot Joke An April Fools' joke (RFC 2324), reserved so it is never assigned. Some servers use it to turn away bots.
419	Page Expired Laravel The CSRF token expired, usually because the form was open too long.
421	Misdirected Request This server cannot answer for this host, usually a reused HTTP/2 connection or a TLS certificate mismatch.
422	Unprocessable Content The syntax is fine but the content is invalid: the usual answer to failed validation in an API.
423	Locked WebDAV The resource is locked.
424	Failed Dependency WebDAV The request failed because a request it depends on failed.
425	Too Early The server will not process a request that might be replayed (TLS 1.3 early data).
426	Upgrade Required Switch to the protocol given in the Upgrade header first.
428	Precondition Required The server requires a conditional request (If-Match) to avoid lost updates.
429	Too Many Requests Rate limited. The Retry-After header may say when to try again.
431	Request Header Fields Too Large The headers are too large, often because of oversized cookies.
444	No Response nginx nginx closed the connection without answering, often to drop unwanted requests.
451	Unavailable For Legal Reasons Blocked for legal reasons such as a court order. The number refers to Fahrenheit 451.
494	Request Header Too Large nginx A header or cookie exceeds the server buffers.
495	SSL Certificate Error nginx The client certificate is invalid.
496	SSL Certificate Required nginx The server requires a client certificate and none was sent.
497	HTTP Request Sent to HTTPS Port nginx Plain HTTP was sent to a port that expects HTTPS.
499	Client Closed Request nginx The client went away before the response was ready. Logged, never received.

5xx Server error The server failed to fulfill a valid request. Retrying later may work.

500	Internal Server Error An unexpected error on the server, such as an uncaught exception.
501	Not Implemented The server does not support this method at all.
502	Bad Gateway A proxy got an invalid response from the server behind it: the app crashed or is not running.
503	Service Unavailable Overloaded or under maintenance. Temporary; Retry-After may say for how long.
504	Gateway Timeout A proxy waited too long for the server behind it.
505	HTTP Version Not Supported The server does not support the HTTP version of the request.
506	Variant Also Negotiates Content negotiation is misconfigured and loops on itself.
507	Insufficient Storage WebDAV The server has no room left to complete the request.
508	Loop Detected WebDAV An infinite loop was found while processing the request.
510	Not Extended Deprecated Further extensions are required (RFC 2774, now historic).
511	Network Authentication Required Log in to the network first: a captive portal, as on hotel Wi-Fi.
520	Web Server Returned an Unknown Error Cloudflare The origin server sent an empty, unknown or unexpected response.
521	Web Server Is Down Cloudflare The origin server refused the connection.
522	Connection Timed Out Cloudflare The TCP connection to the origin server timed out.
523	Origin Is Unreachable Cloudflare The origin server could not be reached, often a DNS or routing problem.
524	A Timeout Occurred Cloudflare The origin server accepted the connection but did not answer within 100 seconds.
525	SSL Handshake Failed Cloudflare The TLS handshake with the origin server failed.
526	Invalid SSL Certificate Cloudflare The origin server's certificate could not be validated.