HTTP Status Codes
An HTTP status code is the three-digit number a server returns with every response — it tells the client whether the request succeeded, needs to be redirected, was rejected, or failed on the server. The first digit sets the class: 1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error.
This section documents every standard status code: what it means, when a server should send it, how browsers and crawlers react, its caching and SEO implications, the real-world mistakes that cause outages and lost rankings, and how WebInspect surfaces it.
- 100 ContinueAn interim response used with the Expect: 100-continue handshake, letting a client withhold a large body until the server confirms the headers are acceptable.
- 101 Switching ProtocolsConfirms a protocol upgrade requested via the Upgrade header — the response that completes a WebSocket handshake over an existing HTTP connection.
- 102 ProcessingA WebDAV interim response indicating a lengthy request is still being processed, sent to stop the client from timing out.
- 103 Early HintsA performance-focused interim response that ships Link preload and preconnect hints early, letting the browser start fetching critical CSS, fonts and scripts while the server builds the page.
- 200 OKThe standard success response: the request was understood and fulfilled, and the body contains the requested resource. The status every healthy page should return.
- 201 CreatedSuccess plus creation: the request succeeded and one or more new resources were created. A Location header should point to the new resource.
- 202 AcceptedThe request was accepted for processing, but the work is not finished. The standard status for asynchronous or queued operations.
- 203 Non-Authoritative InformationThe request succeeded, but the returned headers were altered by a transforming proxy and may not match the origin server's original response.
- 204 No ContentSuccess with no body: the request succeeded but there is nothing to return. Common for DELETE and for saves that leave the client's view unchanged.
- 205 Reset ContentSuccess that also instructs the client to reset its view, such as clearing a form for the next entry. Like 204, it carries no body.
- 206 Partial ContentThe server is returning a byte range rather than the whole resource — the mechanism behind resumable downloads and video/audio streaming with seeking.
- 207 Multi-StatusA WebDAV response whose XML body carries a separate status for each of several resources affected by one request.
- 208 Already ReportedUsed inside a WebDAV 207 body to avoid listing the members of a resource binding more than once when the same collection is enumerated repeatedly.
- 226 IM UsedThe server fulfilled a GET using delta encoding — returning the difference from a version the client already holds rather than the full resource.
- 300 Multiple ChoicesThe requested resource has several representations and the client should choose one — the basis of agent-driven content negotiation.
- 301 Moved PermanentlyA permanent redirect: the resource lives at a new URL for good. Search engines pass ranking signals to the target, making 301 the correct choice for migrations.
- 302 FoundA temporary redirect: the resource is briefly at a different URL, but the original should keep being used. Search engines keep indexing the original URL.
- 303 See OtherRedirects the client to retrieve the result at another URL using GET. The backbone of the Post/Redirect/Get pattern that stops duplicate form submissions.
- 304 Not ModifiedThe cached copy is still good: in response to a conditional request, the server sends no body and the client reuses what it already has — a major bandwidth saver.
- 305 Use ProxyA deprecated status that instructed the client to repeat the request through a given proxy. Removed from active use for security reasons.
- 307 Temporary RedirectA temporary redirect that guarantees the method and body are preserved — the unambiguous, method-safe alternative to 302.
- 308 Permanent RedirectA permanent redirect that preserves the method and body — the method-safe counterpart to 301, ideal for permanently moved API endpoints.
- 400 Bad RequestThe server refused the request because it was malformed — bad syntax, invalid framing, or unparseable input. A generic client-error catch-all.
- 401 UnauthorizedAuthentication is required and either missing or invalid. Despite the name, it is about authentication — proving who you are — not permissions.
- 402 Payment RequiredReserved for future use, but increasingly adopted by APIs to signal a billing, quota or subscription problem blocking the request.
- 403 ForbiddenThe server understood the request and knows who you are, but you are not allowed to do it. An authorization failure, distinct from the authentication failure of 401.
- 404 Not FoundThe resource does not exist at this URL. The most familiar error — correct to return for genuinely missing pages, and important to get right for SEO.
- 405 Method Not AllowedThe resource exists but does not support the HTTP method used. The response must list the permitted methods in an Allow header.
- 406 Not AcceptableThe server cannot produce a representation matching the client's Accept, Accept-Language or Accept-Encoding constraints during content negotiation.
- 407 Proxy Authentication RequiredLike 401, but the authentication is demanded by an intermediary proxy rather than the origin server, via the Proxy-Authenticate header.
- 408 Request TimeoutThe server gave up waiting for the client to complete its request and closed the connection. The client may retry with a fresh connection.
- 409 ConflictThe request could not be completed because it conflicts with the resource's current state — an edit collision, duplicate creation, or version mismatch.
- 410 GoneThe resource is permanently gone and no forwarding address exists. A deliberate, stronger signal than 404 that tells crawlers to deindex faster.
- 411 Length RequiredThe server refuses to accept the request without a Content-Length header defining the body size.
- 412 Precondition FailedA conditional request failed its precondition — for example If-Match did not match the current ETag — preventing a lost-update overwrite.
- 413 Payload Too LargeThe request body is larger than the server is willing or able to process — common on file uploads that exceed a configured limit.
- 414 URI Too LongThe request URI is longer than the server is willing to interpret, frequently a GET carrying data that belongs in a POST body.
- 415 Unsupported Media TypeThe server refuses the request because the body's Content-Type is one it does not support — e.g. sending XML to a JSON-only endpoint.
- 416 Range Not SatisfiableA Range request asked for a byte range the resource cannot satisfy — for instance a start position past the end of the file.
- 417 Expectation FailedThe server cannot satisfy the request's Expect header — almost always an Expect: 100-continue that an intermediary refuses.
- 418 I'm a teapotAn intentionally humorous status from the 1998 Hyper Text Coffee Pot Control Protocol April Fools' RFC — a teapot cannot brew coffee. A beloved Easter egg, not for production.
- 421 Misdirected RequestThe request was routed to a server that cannot respond for the target authority — often an HTTP/2 connection-coalescing mismatch across hostnames sharing a certificate.
- 422 Unprocessable EntityThe syntax is valid but the content fails validation — the widely used status for API field-level validation errors like a missing required field or an invalid value.
- 423 LockedA WebDAV status indicating the resource is locked, so the method cannot be applied until the lock is released.
- 424 Failed DependencyA WebDAV status meaning the request failed because an action it depended on — often an earlier request in the same operation — did not succeed.
- 425 Too EarlyThe server refuses to process a request sent as TLS 1.3 early data (0-RTT) because it could be replayed by an attacker.
- 426 Upgrade RequiredThe server refuses to serve the request on the current protocol and requires the client to switch, naming the target protocol in an Upgrade header.
- 428 Precondition RequiredThe server requires the request to be conditional — forcing clients to send If-Match so concurrent writes cannot silently overwrite each other.
- 429 Too Many RequestsThe client has been rate limited for sending too many requests. A Retry-After header should tell it when to try again.
- 431 Request Header Fields Too LargeThe request's header section is too large for the server to process — frequently caused by a bloated Cookie header or too many custom headers.
- 451 Unavailable For Legal ReasonsThe resource is blocked for legal reasons — a court order, government censorship, or a takedown demand. The number nods to Fahrenheit 451.
- 500 Internal Server ErrorA generic server-side failure: something went wrong on the server and it could not complete the request. The catch-all 5xx when nothing more specific applies.
- 501 Not ImplementedThe server does not support the functionality required — for example an HTTP method it does not recognise at all. Different from 405, which knows the method but forbids it here.
- 502 Bad GatewayA gateway or proxy received an invalid or empty response from the upstream server it was forwarding to. Common at CDNs and load balancers when the origin is unhealthy.
- 503 Service UnavailableThe server is temporarily down — overloaded or in maintenance — but expected back. A Retry-After header tells clients and crawlers when to return.
- 504 Gateway TimeoutA gateway or proxy timed out waiting for the upstream server to respond. Like 502, an origin-side problem — but specifically about slowness, not an invalid reply.
- 505 HTTP Version Not SupportedThe server does not support, or refuses to support, the HTTP protocol version used in the request.
- 506 Variant Also NegotiatesA server misconfiguration in transparent content negotiation: the variant chosen to answer the request is itself a negotiable resource, creating a loop.
- 507 Insufficient StorageA WebDAV status meaning the server cannot complete the request because it lacks the storage to hold the representation.
- 508 Loop DetectedA WebDAV status meaning the server aborted the request because processing it entered an infinite loop, often over cyclic resource bindings.
- 510 Not ExtendedThe server needs a further protocol extension, declared by the client, to fulfil the request under the (rarely used) HTTP extension framework.
- 511 Network Authentication RequiredThe client must authenticate to gain network access — the status a captive portal (hotel or airport Wi-Fi) uses to intercept traffic until you log in.