Look up any HTTP status code to see what it means, why it happens, how to fix it and whether a retry can help, including Cloudflare's 52x codes and other unofficial ones.
No code matches. Try a number, or words like "timeout" or "redirect".
Runs in your browser. Nothing you type or open is uploaded. Free to use, no account. More code and data tools
Interim responses: the request was received and processing continues.
RFC 9110
The server got the request headers and the client may send the body. Used with Expect: 100-continue so a large upload isn't sent to a server that would refuse it.
Common causes
What to do: Nothing to fix. If a proxy mishandles it, have curl send an empty Expect: header.
RFC 9110
The server agrees to switch protocols on this connection, most often to WebSocket after an Upgrade request.
Common causes
What to do: If WebSockets fail behind a proxy, make sure it forwards the Upgrade and Connection headers.
RFC 2518 (WebDAV, deprecated)
An interim response saying the server is still working. Removed from later WebDAV specifications and rarely seen today.
Common causes
What to do: Nothing to fix; clients may ignore it.
RFC 8297
An interim response with Link headers so the browser can preload or preconnect while the server prepares the final response.
Common causes
What to do: Only list resources the page certainly needs; wrong hints waste bandwidth.
IETF draft (temporary IANA registration)
An interim response from the resumable uploads draft (draft-ietf-httpbis-resumable-upload): the server can resume this upload, and its Location header gives the URL to resume at if the connection drops. IANA's registration is temporary until the draft is finished.
Common causes
What to do: Nothing to fix. Clients that don't know the code ignore it, as with any 1xx response.
The request was received, understood and accepted.
RFC 9110Cacheable by defaultAPNs
The request succeeded. The body holds the result: the page for a GET, the outcome of the action for a POST.
Common causes
What to do: If an API returns 200 with an error message in the body, consider a proper 4xx or 5xx so clients and monitors can tell.
RFC 9110
A new resource was created. The Location header should point to it.
Common causes
What to do: Return Location and, usually, the created resource.
RFC 9110
The request was accepted for processing that hasn't finished. Nothing guarantees it will succeed.
Common causes
What to do: Give the client a way to check progress, such as a status URL in Location.
RFC 9110Cacheable by default
Success, but a proxy changed the response the origin sent.
Common causes
What to do: Rare; nothing to fix unless the change is unwanted.
RFC 9110Cacheable by default
Success with no body. Common for DELETE, for PUT that returns nothing and for CORS preflight responses.
Common causes
What to do: Don't send a body with 204; some clients hang or error if you do.
RFC 9110
Success; the client should reset the form or view that sent the request.
Common causes
What to do: Nothing to fix.
RFC 9110Cacheable by default
The body holds only the requested byte ranges (Range header). Used by video players, resumable downloads and PDF viewers.
Common causes
What to do: Send Accept-Ranges: bytes and correct Content-Range headers, or seeking in media breaks (Safari is strict).
RFC 4918 (WebDAV)
A WebDAV response with a separate status for each of several resources in an XML body.
Common causes
What to do: Read each status in the body.
RFC 5842 (WebDAV)
Inside a 207 response: members of this binding were already listed and aren't repeated.
Common causes
What to do: Nothing to fix.
RFC 3229
The server applied instance manipulations (delta encoding) to the response.
Common causes
What to do: Nothing to fix.
The client must take another step, usually follow the Location header.
RFC 9110Cacheable by default
Several representations are available and the server didn't pick one.
Common causes
What to do: Prefer redirecting to one choice.
RFC 9110Cacheable by default
The resource has a new permanent URL, given in Location. Search engines move ranking signals to the new URL. Browsers may change a POST into a GET when following it.
Common causes
What to do: Redirect straight to the final URL (no chains), and use 308 when a POST must stay a POST.
RFC 9110
A temporary redirect to the URL in Location. Browsers usually follow it with GET.
Common causes
What to do: Use 301 or 308 for permanent moves so search engines update; use 307 if the method must not change.
RFC 9110
Look at another URL with GET. The standard answer after a form POST, so a reload doesn't resubmit the form.
Common causes
What to do: Nothing to fix.
RFC 9110
The cached copy is still valid (the request carried If-None-Match or If-Modified-Since). No body is sent.
Common causes
What to do: If changes don't show, check that the ETag or Last-Modified changes when the file does, or use versioned file names.
RFC 9110 (deprecated)
Deprecated for security reasons; clients ignore it.
Common causes
What to do: Don't use it.
RFC 9110 (reserved)
Reserved. It was "Switch Proxy" in a draft and is no longer used.
Common causes
What to do: Don't use it.
RFC 9110
A temporary redirect that keeps the method and body: a POST stays a POST. Browsers also show 307 internally for HSTS upgrades to https.
Common causes
What to do: Nothing to fix for HSTS; for real moves, decide between temporary (307) and permanent (308).
RFC 9110Cacheable by default
A permanent redirect that keeps the method and body. The safe choice for permanently moved API endpoints.
Common causes
What to do: Update clients to the new URL; keep the redirect for old ones.
Something in the request is wrong. Fix it before trying again.
RFC 9110APNs
The server can't process the request because something in it is malformed: syntax, framing, parameters or a too-large cookie.
Common causes
What to do: Read the error body, validate the payload, check Content-Type, and clear the site's cookies if a browser shows it.
Retry: Don't retry unchanged: fix the request first.
From Apple's push service, the JSON body's reason says more: see APNs error codes.
RFC 9110
Authentication is missing or invalid. Despite the name, it means unauthenticated; the server must send WWW-Authenticate.
Common causes
What to do: Send valid credentials; refresh an expired token and retry once.
Retry: Retry once after refreshing credentials; otherwise don't.
RFC 9110 (reserved)
Reserved for future use. Some APIs return it when a plan's quota or billing has run out.
Common causes
What to do: Check the provider's billing page.
Retry: Don't retry unchanged: fix the request first.
RFC 9110APNs
The server understood who you are (or doesn't care) and refuses. Re-authenticating won't help.
Common causes
What to do: Check the account's permissions, the WAF or firewall logs, and file ownership on the server.
Retry: Don't retry unchanged: fix the request first.
From Apple's push service, the JSON body's reason says more: see APNs error codes.
RFC 9110Cacheable by defaultAPNs
No resource at this URL, or the server won't say whether one exists. Cacheable by default.
Common causes
What to do: Fix the link, or redirect a moved page with 301. For content removed for good, 410 Gone says so explicitly.
Retry: Don't retry unchanged: fix the request first.
From Apple's push service, the JSON body's reason says more: see APNs error codes.
RFC 9110Cacheable by defaultAPNs
The URL exists but doesn't accept this method. The Allow header lists those it does.
Common causes
What to do: Use an allowed method, or add the method or the OPTIONS handler on the server.
Retry: Don't retry unchanged: fix the request first.
From Apple's push service, the JSON body's reason says more: see APNs error codes.
RFC 9110
The server can't produce a representation matching the Accept headers.
Common causes
What to do: Send Accept: application/json (or */*).
Retry: Don't retry unchanged: fix the request first.
RFC 9110
Like 401, but a proxy between you and the server wants credentials.
Common causes
What to do: Configure the proxy credentials in the client.
Retry: Don't retry unchanged: fix the request first.
RFC 9110
The server gave up waiting for the client to finish sending the request, and usually closes the connection.
Common causes
What to do: Retrying is safe: the server didn't process the request.
Retry: Safe to retry: the request wasn't processed.
RFC 9110
The request conflicts with the current state of the resource.
Common causes
What to do: Fetch the current state, resolve the conflict and send again.
Retry: Don't retry unchanged: fix the request first.
RFC 9110Cacheable by defaultAPNs
The resource was deliberately removed and won't come back. Cacheable by default. APNs uses it for device tokens that are no longer active.
Common causes
What to do: Remove links to it; for APNs, stop sending to that token.
Retry: Don't retry unchanged: fix the request first.
From Apple's push service, the JSON body's reason says more: see APNs error codes.
RFC 9110
The server wants a Content-Length header.
Common causes
What to do: Send Content-Length.
Retry: Don't retry unchanged: fix the request first.
RFC 9110
A condition in the request (If-Match, If-Unmodified-Since) is false: someone else changed the resource.
Common causes
What to do: Fetch the latest version and retry with its ETag.
Retry: Don't retry unchanged: fix the request first.
RFC 9110APNs
The request body is larger than the server allows. Formerly "Payload Too Large".
Common causes
What to do: Raise the limit on the server, or send less data.
Retry: Don't retry unchanged: fix the request first.
From Apple's push service, the JSON body's reason says more: see APNs error codes.
RFC 9110Cacheable by default
The URL is longer than the server will read.
Common causes
What to do: Move data into a POST body; check for redirect loops.
Retry: Don't retry unchanged: fix the request first.
RFC 9110
The server doesn't accept the body's format.
Common causes
What to do: Send the Content-Type the API expects, such as application/json.
Retry: Don't retry unchanged: fix the request first.
RFC 9110
The requested byte range is outside the file.
Common causes
What to do: Request the whole file again.
Retry: Don't retry unchanged: fix the request first.
RFC 9110
The server can't meet the Expect header.
Common causes
What to do: Send without the Expect header.
Retry: Don't retry unchanged: fix the request first.
RFC 9110 (reserved)
An April Fools' code from RFC 2324. RFC 9110 reserves 418 so it is never given a real meaning; some servers return it as a joke or to turn away bots.
Common causes
What to do: Nothing to fix unless a server uses it to block you.
Retry: Don't retry unchanged: fix the request first.
RFC 9110
The request reached a server that can't answer for that host, typically on a reused HTTP/2 connection.
Common causes
What to do: Clients retry on a new connection; servers should serve the right certificate per host.
Retry: Retry on a new connection.
RFC 9110
The body is well formed but its content is invalid, such as a failed validation.
Common causes
What to do: Read the error details and correct the fields.
Retry: Don't retry unchanged: fix the request first.
RFC 4918 (WebDAV)
The resource is locked.
Common causes
What to do: Wait for the lock to be released.
Retry: Don't retry unchanged: fix the request first.
RFC 4918 (WebDAV)
The request failed because another request it depended on failed.
Common causes
What to do: Fix the failed operation first.
Retry: Don't retry unchanged: fix the request first.
RFC 8470
The server won't process a request sent as TLS early data (0-RTT), because it could be replayed.
Common causes
What to do: Clients retry after the handshake completes.
Retry: Retry after the TLS handshake completes.
RFC 9110
The server refuses this protocol; the Upgrade header names the one to use.
Common causes
What to do: Switch protocol as indicated.
Retry: Don't retry unchanged: fix the request first.
RFC 6585
The server requires a conditional request (If-Match) to prevent lost updates.
Common causes
What to do: Send If-Match with the current ETag.
Retry: Don't retry unchanged: fix the request first.
RFC 6585APNs
Rate limited: too many requests in a given time. APNs returns it when one device token gets too many pushes.
Common causes
What to do: Slow down, honour Retry-After, add jitter to retries and cache responses.
Retry: Wait for the Retry-After header (seconds or a date) before retrying; without one, back off exponentially.
From Apple's push service, the JSON body's reason says more: see APNs error codes.
RFC 6585
The headers, or one header, are too large.
Common causes
What to do: Clear cookies for the site; trim tokens; raise server header limits.
Retry: Don't retry unchanged: fix the request first.
RFC 7725
Access is denied because of a legal demand, such as a court order or sanctions.
Common causes
What to do: Nothing to fix technically.
Retry: Don't retry unchanged: fix the request first.
The server failed to handle a valid request. Often temporary.
RFC 9110APNs
A generic server failure: the code crashed or hit an unhandled error.
Common causes
What to do: Check the server's error log for the stack trace; fix the bug or config.
Retry: Safe to retry idempotent requests (GET, PUT, DELETE) with exponential backoff; retry a POST only if it carries an idempotency key.
From Apple's push service, the JSON body's reason says more: see APNs error codes.
RFC 9110Cacheable by default
The server doesn't support the functionality needed, such as an unknown method. Cacheable by default.
Common causes
What to do: Use a supported method.
Retry: Don't retry unchanged: fix the request first.
RFC 9110
A proxy or gateway got an invalid response from the upstream server.
Common causes
What to do: Check that the upstream process is up and listening on the right socket or port, and read the proxy's error log.
Retry: Safe to retry idempotent requests (GET, PUT, DELETE) with exponential backoff; retry a POST only if it carries an idempotency key.
RFC 9110APNs
The server is temporarily unable to handle the request: overloaded or in maintenance. Search engines treat a short 503 as temporary.
Common causes
What to do: Send Retry-After during maintenance; scale up or shed load.
Retry: Wait for the Retry-After header (seconds or a date) before retrying; without one, back off exponentially.
From Apple's push service, the JSON body's reason says more: see APNs error codes.
RFC 9110
A proxy or gateway didn't get a response from upstream in time.
Common causes
What to do: Speed up the slow call, move long work to a background job, or raise the proxy timeout.
Retry: Safe to retry idempotent requests (GET, PUT, DELETE) with exponential backoff; retry a POST only if it carries an idempotency key.
RFC 9110
The server doesn't support the HTTP version used.
Common causes
What to do: Use HTTP/1.1.
Retry: Don't retry unchanged: fix the request first.
RFC 2295
A content negotiation configuration error on the server.
Common causes
What to do: Fix the server configuration.
Retry: Don't retry unchanged: fix the request first.
RFC 4918 (WebDAV)
The server can't store what's needed to complete the request.
Common causes
What to do: Free space or raise the quota.
Retry: Wait for the Retry-After header (seconds or a date) before retrying; without one, back off exponentially.
RFC 5842 (WebDAV)
The server found an infinite loop while processing. Some hosts also use it when an account hits its resource limits.
Common causes
What to do: Fix the loop, or ask the host about resource limits.
Retry: Don't retry unchanged: fix the request first.
RFC 2774 (historic)
Further extensions to the request are required. The extension framework is obsolete.
Common causes
What to do: Nothing to fix.
Retry: Don't retry unchanged: fix the request first.
RFC 6585
A captive portal (hotel or airport Wi-Fi) wants you to log in before you can use the network.
Common causes
What to do: Open any page in a browser and log in to the network.
Retry: Don't retry unchanged: fix the request first.
Cloudflare shows these when the problem is between Cloudflare and your server (the origin), not between the visitor and Cloudflare. Testing the origin directly, for example with curl and a hosts-file entry or the origin's IP, separates the two.
Unofficial: Cloudflare
Cloudflare got an empty, unknown or unexpected response from your origin server.
Common causes
What to do: Check the origin's logs at the time of the error; test the origin directly, bypassing Cloudflare; look for crashes and oversized headers or cookies.
Retry: Safe to retry idempotent requests (GET, PUT, DELETE) with exponential backoff; retry a POST only if it carries an idempotency key.
Unofficial: Cloudflare
The origin refused Cloudflare's connection.
Common causes
What to do: Start the web server; allow Cloudflare's published IP ranges in the firewall.
Retry: Safe to retry idempotent requests (GET, PUT, DELETE) with exponential backoff; retry a POST only if it carries an idempotency key.
Unofficial: Cloudflare
Cloudflare couldn't complete a TCP connection to the origin in time.
Common causes
What to do: Check the origin IP in Cloudflare DNS, allow Cloudflare's IP ranges, and check server load.
Retry: Safe to retry idempotent requests (GET, PUT, DELETE) with exponential backoff; retry a POST only if it carries an idempotency key.
Unofficial: Cloudflare
Cloudflare can't route to the origin at all.
Common causes
What to do: Check the A/AAAA records in Cloudflare DNS against the server's IP; ask the host about routing.
Retry: Safe to retry idempotent requests (GET, PUT, DELETE) with exponential backoff; retry a POST only if it carries an idempotency key.
Unofficial: Cloudflare
Cloudflare connected to the origin, but the origin didn't send an HTTP response before the proxy read timeout (100 seconds by default).
Common causes
What to do: Return quickly and finish long work in a background job (poll or use a webhook); Enterprise plans can raise the timeout.
Retry: Safe to retry idempotent requests (GET, PUT, DELETE) with exponential backoff; retry a POST only if it carries an idempotency key.
Unofficial: Cloudflare
The TLS handshake between Cloudflare and the origin failed (SSL mode Full or Full strict).
Common causes
What to do: Install a certificate on the origin (a Cloudflare Origin CA certificate works) and check that port 443 answers TLS.
Retry: Safe to retry idempotent requests (GET, PUT, DELETE) with exponential backoff; retry a POST only if it carries an idempotency key.
Unofficial: Cloudflare
In Full (strict) mode, the origin's certificate couldn't be validated.
Common causes
What to do: Renew or replace the origin certificate, or use a Cloudflare Origin CA certificate.
Retry: Don't retry unchanged: fix the request first.
Unofficial: Cloudflare (retired)
A connection error with Cloudflare's Railgun service, which has been retired.
Common causes
What to do: Remove the Railgun configuration.
Retry: Don't retry unchanged: fix the request first.
Unofficial: Cloudflare
Has no official name. Returned together with a Cloudflare 1xxx error, such as 1016 (origin DNS error) or 1033 (Cloudflare Tunnel error). The page shows the 1xxx number.
Common causes
What to do: Look up the 1xxx error shown on the page; fix the DNS record or restart the tunnel.
Retry: Safe to retry idempotent requests (GET, PUT, DELETE) with exponential backoff; retry a POST only if it carries an idempotency key.
Servers, frameworks and load balancers that invented their own numbers. Some, like nginx's 499, appear only in logs and are never sent to clients.
Unofficial: Laravel
Laravel returns it when the CSRF token in a form is missing or expired.
Common causes
What to do: Reload the form; include the CSRF token; check session and cookie settings.
Retry: Don't retry unchanged: fix the request first.
Unofficial: old Twitter API
Twitter's original API returned it for rate limiting before 429 existed.
Common causes
What to do: Treat it like 429.
Retry: Wait for the Retry-After header (seconds or a date) before retrying; without one, back off exponentially.
Unofficial: Microsoft IIS
The client's session expired and it must log in again.
Common causes
What to do: Log in again.
Retry: Don't retry unchanged: fix the request first.
Unofficial: nginx
Used in nginx configuration to close the connection without sending anything. Clients see an empty reply, not the number.
Common causes
What to do: Check the nginx server blocks for return 444.
Retry: Don't retry unchanged: fix the request first.
Unofficial: Microsoft IIS
The request should be retried after performing the indicated action.
Common causes
What to do: Follow the server's instructions.
Retry: Don't retry unchanged: fix the request first.
Unofficial: Microsoft
Windows parental controls blocked the page.
Common causes
What to do: Change the parental control settings.
Retry: Don't retry unchanged: fix the request first.
Unofficial: AWS Elastic Load Balancing
The client closed the connection before the load balancer's idle timeout ended.
Common causes
What to do: Raise the client timeout or speed up the backend.
Unofficial: AWS Elastic Load Balancing
The load balancer got an X-Forwarded-For header with too many IP addresses (more than 30).
Common causes
What to do: Fix the proxy chain.
Retry: Don't retry unchanged: fix the request first.
Unofficial: nginx
nginx's internal code for headers over its limit; it answers 400 to the client.
Common causes
What to do: Raise large_client_header_buffers or trim cookies.
Retry: Don't retry unchanged: fix the request first.
Unofficial: nginx
The client certificate was invalid (mutual TLS); sent to the client as 400.
Common causes
What to do: Fix the client certificate.
Retry: Don't retry unchanged: fix the request first.
Unofficial: nginx
A client certificate was required but not sent; sent to the client as 400.
Common causes
What to do: Send the client certificate.
Retry: Don't retry unchanged: fix the request first.
Unofficial: nginx
Plain HTTP arrived on a port that expects TLS; sent to the client as 400.
Common causes
What to do: Use https://, or redirect with error_page 497.
Retry: Don't retry unchanged: fix the request first.
Unofficial: nginx
Logged by nginx when the client closed the connection before the response was ready. The client never sees it.
Common causes
What to do: If frequent, speed up slow endpoints or align timeouts along the chain.
Unofficial: cPanel and Apache modules
The hosting account exceeded its bandwidth allowance.
Common causes
What to do: Upgrade the plan or reduce traffic (images, a CDN).
Retry: Don't retry unchanged: fix the request first.
Unofficial: AWS Elastic Load Balancing
The load balancer's authentication action (OIDC or Cognito) failed.
Common causes
What to do: Check the listener's authentication settings and the identity provider.
Retry: Don't retry unchanged: fix the request first.
Unofficial: some proxies
Some HTTP proxies use it for a read timeout behind them.
Common causes
What to do: Check the upstream.
Retry: Safe to retry idempotent requests (GET, PUT, DELETE) with exponential backoff; retry a POST only if it carries an idempotency key.
Unofficial: some proxies
Some HTTP proxies use it for a connect timeout behind them.
Common causes
What to do: Check the upstream.
Retry: Safe to retry idempotent requests (GET, PUT, DELETE) with exponential backoff; retry a POST only if it carries an idempotency key.
A retry is safe when repeating the request can't do harm. GET, HEAD, PUT and DELETE are idempotent by definition, so they can be retried after 500, 502, 503 or 504 with exponential backoff and a little random jitter. POST isn't: a retried payment can charge twice unless the API supports an idempotency key. 429 and 503 often carry Retry-After, which says how long to wait.
RFC 9110 lets caches store some responses even without explicit freshness headers: 200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414 and 501. Those carry the Cacheable by default badge above. In practice, set Cache-Control yourself, especially on 404 and 301 responses that you may want to change later.
Search engines index 2xx pages, follow 301 and 308 as permanent moves and 302 and 307 as temporary ones, drop 404 and 410 pages from the index over time (410 can be a little faster), and slow down crawling when they see 429, 500 or 503. A page that says "not found" but answers 200 is a soft 404, which wastes crawl budget. Answer with the real status code.
Private by design
This is a reference page. The search box filters the table in your browser; this tool doesn't send what you type anywhere. Your last search and filter are kept in this browser so they are there when you come back.
This page also shows Google ads, which can use cookies. Privacy and cookies explains how.
Found it useful? You're welcome to link to it from your README, docs or blog.
401 means the request isn't authenticated: credentials are missing, expired or wrong, and sending valid ones may work. 403 means the server knows who you are, or doesn't need to, and refuses anyway: logging in again won't help.
Both are permanent. Browsers may turn a POST into a GET when following a 301, while 308 keeps the method and body. Use 301 for pages and 308 for API endpoints that receive POST, PUT or PATCH.
A proxy such as nginx, a load balancer or a CDN got a broken response, or none, from the server behind it. Usually the application process crashed, isn't running or listens on a different port or socket. The proxy's error log names the upstream that failed.
Cloudflare reached your server, but the server didn't start sending a response within the proxy read timeout, 100 seconds by default. Make long tasks run in the background and answer quickly, or ask about a longer timeout on an Enterprise plan.
408, 429, 500, 502, 503 and 504 are worth retrying with exponential backoff, respecting Retry-After when it is present, and only for idempotent requests or requests with an idempotency key. Other 4xx errors will fail again until the request changes.