HTTP Status Codes
Look up any HTTP status code and what it actually means — including the nginx and Cloudflare codes that show up in real logs.
71 of 71 shown
| Code | Name | Meaning |
|---|---|---|
| 100 | Continue | The client should continue with its request. Sent in response to an Expect: 100-continue header. |
| 101 | Switching Protocols | The server is switching protocols as requested — most often upgrading to WebSockets. |
| 102 | Processing | WebDAV. The server has accepted the request but has not yet completed it. |
| 103 | Early Hints | Sends preload hints before the final response, letting the browser start fetching assets sooner. |
| 200 | OK | The request succeeded. The meaning of the body depends on the method used. |
| 201 | Created | The request succeeded and created a new resource. The Location header should point to it. |
| 202 | Accepted | The request was accepted for processing but has not completed — typical for async jobs. |
| 203 | Non-Authoritative Information | The response was modified by a proxy and differs from the origin server's. |
| 204 | No Content | Success, with no body to return. Common for DELETE and for PUT updates. |
| 205 | Reset Content | Success. Tells the client to reset the document view, such as clearing a form. |
| 206 | Partial Content | Returns part of the resource in response to a Range header — used for resumable downloads and media seeking. |
| 207 | Multi-Status | WebDAV. The body contains multiple status codes for independent sub-requests. |
| 208 | Already Reported | WebDAV. Members of a binding were already enumerated and are not being repeated. |
| 226 | IM Used | The response is the result of applying instance manipulations to the resource. |
| 300 | Multiple Choices | The request has more than one possible response and the client should pick one. |
| 301 | Moved Permanently | The resource has permanently moved. Search engines transfer ranking to the new URL. |
| 302 | Found | The resource is temporarily at a different URL. The original URL should keep being used. |
| 303 | See Other | Fetch the resource at another URI using GET — the standard post/redirect/get pattern. |
| 304 | Not Modified | The cached version is still valid, so no body is sent. Driven by ETag or Last-Modified. |
| 305 | Use Proxy | Deprecated. The resource must be accessed through the proxy given in the response. |
| 307 | Temporary Redirect | Like 302, but the method and body must not be changed when following the redirect. |
| 308 | Permanent Redirect | Like 301, but the method and body must not be changed when following the redirect. |
| 400 | Bad Request | The server cannot process the request due to malformed syntax or invalid framing. |
| 401 | Unauthorized | Authentication is required or has failed. Despite the name, this means unauthenticated. |
| 402 | Payment Required | Reserved for future use. Occasionally used by APIs to signal a billing problem. |
| 403 | Forbidden | The server understood the request but refuses it. Authenticating will not help. |
| 404 | Not Found | The server cannot find the requested resource, and will not say whether it ever existed. |
| 405 | Method Not Allowed | The method is known but not supported by this resource. Must include an Allow header. |
| 406 | Not Acceptable | No representation matches the client's Accept headers. |
| 407 | Proxy Authentication Required | Like 401, but authentication must be done with the proxy. |
| 408 | Request Timeout | The server timed out waiting for the request. Some servers send this on idle connections. |
| 409 | Conflict | The request conflicts with the current state — a version conflict or duplicate key, for example. |
| 410 | Gone | The resource is permanently gone with no forwarding address. Stronger and more final than 404. |
| 411 | Length Required | The server requires a Content-Length header, which the request did not provide. |
| 412 | Precondition Failed | A precondition in the request headers (such as If-Match) evaluated to false. |
| 413 | Content Too Large | The request body is larger than the server is willing to process. Formerly Payload Too Large. |
| 414 | URI Too Long | The request URI is longer than the server will interpret — often a GET that should be a POST. |
| 415 | Unsupported Media Type | The body's media type is not supported. Usually a wrong or missing Content-Type. |
| 416 | Range Not Satisfiable | The Range header asks for a portion that lies outside the resource. |
| 417 | Expectation Failed | The expectation in the Expect header could not be met by the server. |
| 418 | I'm a teapot | An April Fools' joke from RFC 2324. Some services use it as a deliberate refusal. |
| 421 | Misdirected Request | The request was routed to a server that cannot produce a response for this authority. |
| 422 | Unprocessable Content | The syntax is correct but the content is semantically wrong — the usual validation-failure code. |
| 423 | Locked | WebDAV. The resource being accessed is locked. |
| 424 | Failed Dependency | WebDAV. The request failed because a previous request it depended on failed. |
| 425 | Too Early | The server is unwilling to process a request that might be replayed. |
| 426 | Upgrade Required | The client must switch to a different protocol, named in the Upgrade header. |
| 428 | Precondition Required | The server requires a conditional request, to avoid lost-update conflicts. |
| 429 | Too Many Requests | Rate limit exceeded. A Retry-After header should say how long to wait. |
| 431 | Request Header Fields Too Large | The headers are too large — frequently an oversized or accumulated cookie. |
| 451 | Unavailable For Legal Reasons | The resource is blocked for legal reasons, such as a takedown order. |
| 500 | Internal Server Error | A generic server-side failure with no more specific message available. |
| 501 | Not Implemented | The server does not support the functionality required to fulfil the request. |
| 502 | Bad Gateway | A gateway or proxy got an invalid response from the upstream server. |
| 503 | Service Unavailable | The server is overloaded or down for maintenance. Usually temporary. |
| 504 | Gateway Timeout | A gateway or proxy did not get a response from upstream in time. |
| 505 | HTTP Version Not Supported | The HTTP version used in the request is not supported. |
| 506 | Variant Also Negotiates | A content negotiation configuration error on the server. |
| 507 | Insufficient Storage | WebDAV. The server cannot store the representation needed to complete the request. |
| 508 | Loop Detected | WebDAV. The server detected an infinite loop while processing the request. |
| 510 | Not Extended | Further extensions to the request are required for the server to fulfil it. |
| 511 | Network Authentication Required | The client must authenticate to gain network access — typical of captive portals. |
| 444 | No Response(nginx) | nginx closes the connection without sending a response. Used to drop malicious requests. |
| 499 | Client Closed Request(nginx) | The client closed the connection while nginx was still processing the request. |
| 520 | Web Server Returned an Unknown Error(Cloudflare) | The origin returned something empty or unexpected that Cloudflare could not interpret. |
| 521 | Web Server Is Down(Cloudflare) | The origin refused Cloudflare's connection — often a firewall blocking Cloudflare IPs. |
| 522 | Connection Timed Out(Cloudflare) | Cloudflare could not establish a TCP connection to the origin in time. |
| 523 | Origin Is Unreachable(Cloudflare) | Cloudflare cannot reach the origin — commonly a bad DNS record. |
| 524 | A Timeout Occurred(Cloudflare) | Cloudflare connected but the origin did not respond before the timeout. |
| 525 | SSL Handshake Failed(Cloudflare) | The TLS handshake between Cloudflare and the origin failed. |
| 526 | Invalid SSL Certificate(Cloudflare) | The origin's TLS certificate could not be validated. |
Quick rules of thumb:
- 401 vs 403 — 401 means you are not authenticated; 403 means you are, and still may not.
- 301 vs 302 — 301 is permanent and transfers SEO ranking; 302 is temporary and does not.
- 307/308 preserve the method and body; 301/302 may let a client rewrite a POST into a GET.
- 422 vs 400 — 400 is malformed syntax; 422 parses fine but fails validation.
Your Data Never Leaves Your Device
Every tool runs entirely in your browser. Nothing you type is uploaded, stored, or logged on our servers.
This HTTP status code reference covers every code defined in RFC 9110 and its companions, grouped into the five classes: 1xx informational, 2xx success, 3xx redirection, 4xx client error, and 5xx server error. Search by number, by name, or by what you remember of the meaning — searching “gateway” finds 502 and 504, and “redirect” finds the whole 3xx family.
It also includes the non-standard codes you actually hit in production: nginx's 444 and 499, and Cloudflare's 520-526 range. Those appear in no RFC, which is exactly why they are hard to look up when a log is full of them — a 521 means Cloudflare could not reach your origin at all, which is a very different problem from a 500 coming out of your own application.
FAQ
401 Unauthorized means you have not authenticated — despite its name it signals missing or invalid credentials. 403 Forbidden means you are authenticated but still not permitted, so retrying with credentials will not help.
Use 301 for a permanent move — search engines transfer ranking to the new URL and browsers cache it aggressively. Use 302 when the original URL should keep being used, such as a temporary maintenance page.
Clients are allowed to rewrite the method when following 301 and 302. Use 308 or 307 instead — they preserve the original method and body.
400 means the request itself is malformed and could not be parsed. 422 means it parsed fine but failed semantic validation, which is the usual case for a well-formed JSON body with an invalid field.
Both come from a proxy or gateway. 502 means the upstream returned something invalid, 504 means the upstream did not respond in time. Neither is generated by your application code — look at the layer in front of it.
No. Codes in the 520-527 range are Cloudflare-specific, and 444 and 499 are nginx-specific. They are not in any RFC, but they appear often enough in production logs to be worth recognising.