511 Network Authentication Required
The client must authenticate to gain network access — the status a captive portal (hotel or airport Wi-Fi) uses to intercept traffic until you log in.
What it means
511 Network Authentication Required (RFC 6585) is meant to be returned by an intercepting proxy — a captive portal — not by the origin. It tells the client that network access is gated behind a login page. Because it is not from the origin, clients should not cache it against the original URL.
Why it matters
- It gives captive portals a proper status instead of hijacking requests with misleading 200s or redirects.
- It helps clients detect a portal and surface the login flow.
Common mistakes
- Origin servers returning 511 (it is only for intercepting proxies).
- Portals using 302 redirects that confuse HTTPS clients instead of a clear 511.
How WebInspect checks this
- WebInspect reports the status and any portal-related redirects encountered during a scan.