HTTP status codes
Search by number, name or symptom. “rate limit” finds 429.
| Code | Meaning | Defined in |
|---|---|---|
| 100Continue | Keep sending the request body. Sent after a client asks with Expect: 100-continue. | RFC 9110 |
| 101Switching Protocols | The server agrees to change protocol, most often to WebSocket. | RFC 9110 |
| 102Processing | WebDAV: the request is still being worked on, so the client does not time out. | RFC 2518 |
| 103Early Hints | Preload hints sent before the real response, so the browser can start fetching assets. | RFC 8297 |
| 200OK | The request worked and the body holds the result. | RFC 9110 |
| 201Created | A new resource exists. Put its address in the Location header. | RFC 9110 |
| 202Accepted | Queued, not finished. Use it for work that completes later. | RFC 9110 |
| 203Non-Authoritative Information | Returned, but a proxy changed the body on the way. | RFC 9110 |
| 204No Content | It worked and there is deliberately no body. Common for DELETE and for saves. | RFC 9110 |
| 205Reset Content | It worked; the client should clear the form that sent it. | RFC 9110 |
| 206Partial Content | The piece asked for by a Range header, used for resuming downloads and video seeking. | RFC 9110 |
| 207Multi-Status | WebDAV: one response carrying a separate status for each item. | RFC 4918 |
| 208Already Reported | WebDAV: this item was already listed earlier in the same response. | RFC 5842 |
| 226IM Used | The body is the result of applying a delta encoding to the resource. | RFC 3229 |
| 300Multiple Choices | Several versions exist and the client has to pick one. Rare in practice. | RFC 9110 |
| 301Moved Permanently | Use the new address from now on. Search engines pass ranking to the new URL. | RFC 9110 |
| 302Found | A temporary redirect. Keep the original address; most clients switch to GET. | RFC 9110 |
| 303See Other | Fetch the result from another address with GET. The usual reply after a form POST. | RFC 9110 |
| 304Not Modified | The cached copy is still good, so no body is sent. Answers If-None-Match and If-Modified-Since. | RFC 9110 |
| 307Temporary Redirect | Like 302, but the method and body must be kept, so a POST stays a POST. | RFC 9110 |
| 308Permanent Redirect | Like 301, but the method and body must be kept. | RFC 9110 |
| 400Bad Request | The request itself is malformed. Do not use it for business-rule failures; prefer 422. | RFC 9110 |
| 401Unauthorized | Really means "unauthenticated": sign in first. Must come with a WWW-Authenticate header. | RFC 9110 |
| 402Payment Required | Reserved. Used informally for quota and billing limits. | RFC 9110 |
| 403Forbidden | Identity is known and still not allowed. Signing in again will not help. | RFC 9110 |
| 404Not Found | Nothing lives at this address, and the server will not say whether it ever did. | RFC 9110 |
| 405Method Not Allowed | The address exists but not for this verb. Must list the allowed ones in Allow. | RFC 9110 |
| 406Not Acceptable | No version matches the Accept header the client sent. | RFC 9110 |
| 407Proxy Authentication Required | Like 401, but the proxy wants credentials. | RFC 9110 |
| 408Request Timeout | The client took too long to send the request. | RFC 9110 |
| 409Conflict | It clashes with the current state, such as an edit against a stale version. | RFC 9110 |
| 410Gone | Deliberately removed and not coming back. Stronger than 404, and drops from search faster. | RFC 9110 |
| 411Length Required | The server insists on a Content-Length header. | RFC 9110 |
| 412Precondition Failed | An If-Match or If-Unmodified-Since condition did not hold. | RFC 9110 |
| 413Content Too Large | The body is bigger than the server accepts. Was "Payload Too Large". | RFC 9110 |
| 414URI Too Long | The address is too long, usually from a GET that should have been a POST. | RFC 9110 |
| 415Unsupported Media Type | The Content-Type is not one the endpoint handles. | RFC 9110 |
| 416Range Not Satisfiable | The requested byte range lies outside the file. | RFC 9110 |
| 417Expectation Failed | The Expect header cannot be met. | RFC 9110 |
| 418I'm a teapot | An April Fools joke from 1998 that never left. Never use it in earnest. | RFC 2324 |
| 421Misdirected Request | This server cannot answer for that authority; common with shared HTTP/2 connections. | RFC 9110 |
| 422Unprocessable Content | Well formed but semantically wrong — the usual answer to failed validation. | RFC 9110 |
| 423Locked | WebDAV: the resource is locked. | RFC 4918 |
| 424Failed Dependency | WebDAV: an earlier step in the same request failed. | RFC 4918 |
| 425Too Early | The server will not risk replaying an early-data request. | RFC 8470 |
| 426Upgrade Required | Switch protocol, for example to TLS, and try again. | RFC 9110 |
| 428Precondition Required | Send an If-Match header, so two clients cannot overwrite each other blindly. | RFC 6585 |
| 429Too Many Requests | Rate limited. Send Retry-After so the client knows how long to wait. | RFC 6585 |
| 431Request Header Fields Too Large | The headers are too big, often an oversized cookie. | RFC 6585 |
| 451Unavailable For Legal Reasons | Blocked by law or a court order. The number nods to Fahrenheit 451. | RFC 7725 |
| 500Internal Server Error | The catch-all for an unhandled fault. Check the logs; the client can do nothing. | RFC 9110 |
| 501Not Implemented | The server does not support this method at all. | RFC 9110 |
| 502Bad Gateway | A proxy got an invalid reply from upstream. Usually the app behind it is down. | RFC 9110 |
| 503Service Unavailable | Down for maintenance or overloaded. Add Retry-After; it keeps search rankings safe. | RFC 9110 |
| 504Gateway Timeout | A proxy waited too long for upstream. Often a slow query or a stuck worker. | RFC 9110 |
| 505HTTP Version Not Supported | The HTTP version in the request is refused. | RFC 9110 |
| 506Variant Also Negotiates | Content negotiation is misconfigured and loops. | RFC 2295 |
| 507Insufficient Storage | WebDAV: no room left to store the representation. | RFC 4918 |
| 508Loop Detected | WebDAV: an infinite loop while processing. | RFC 5842 |
| 510Not Extended | Further extensions are required to answer the request. | RFC 2774 |
| 511Network Authentication Required | A captive portal wants you to sign in to the network. | RFC 6585 |
No status code matches that.
Domande frequenti
What is the difference between 401 and 403?
401 means the server does not know who you are: sign in and try again. 403 means it knows exactly who you are and you still may not do this, so signing in again will not help.
Should a failed form validation be 400 or 422?
400 is for a request the server cannot parse at all — broken JSON, a missing required header. Use 422 when the request is well formed but the values break a rule, which is what most validation failures are.
Which redirect should I use?
301 for a permanent move, so search engines pass the ranking on. 302 or 307 for a temporary one. The difference between 302 and 307 is that 307 keeps the method, so a POST stays a POST; use 303 when you want to send the browser to a result page with GET after a form submission.