HTTP Status Codes

511 Network Authentication Required

The client must authenticate to gain network access — the status a captive portal (hotel or airport Wi-Fi) uses to intercept traffic until you log in.

What it means

511 Network Authentication Required (RFC 6585) is meant to be returned by an intercepting proxy — a captive portal — not by the origin. It tells the client that network access is gated behind a login page. Because it is not from the origin, clients should not cache it against the original URL.

Why it matters

  • It gives captive portals a proper status instead of hijacking requests with misleading 200s or redirects.
  • It helps clients detect a portal and surface the login flow.

Common mistakes

  • Origin servers returning 511 (it is only for intercepting proxies).
  • Portals using 302 redirects that confuse HTTPS clients instead of a clear 511.

How WebInspect checks this

  • WebInspect reports the status and any portal-related redirects encountered during a scan.