HTTP Status Codes — Every Code Explained, With Causes and Fixes
Search 70 status codes by number, class or keyword: what each one means, why you are seeing it, and what to do about it.
🔒 Runs in your browser — files never uploaded ⚡ No signup 💯 Free
A searchable reference to HTTP status codes: every registered code from 100 to 511, plus the unofficial ones you actually meet in the wild — nginx's 499 and Cloudflare's 520–526. Each entry gives the meaning in plain language, the usual cause, and what to do. Type a number, a class like 5xx, or a word like timeout; link straight to a code with #404 in the address.
How to use HTTP Status Codes
- Search by number (404), prefix (40), class (5xx) or keyword (redirect, cache, timeout).
- Open an entry for the explanation and the common cause.
- Copy the "code name" pair for a ticket or a commit message.
The five classes
- 1xx Informational — the request was received, keep going. You rarely see these; 101 is the WebSocket upgrade, 103 lets the browser preload assets early.
- 2xx Success — it worked. 200 with a body, 201 when something was created, 204 when there is nothing to return, 206 for a byte range.
- 3xx Redirection — look elsewhere. 301 permanent, 302 temporary, 307/308 the same but the method is preserved, 304 "your cached copy is fine".
- 4xx Client error — the request is wrong. 400 malformed, 401 not logged in, 403 logged in but not allowed, 404 no such thing, 405 wrong verb, 409 conflict, 422 validation failed, 429 slow down.
- 5xx Server error — the server is wrong. 500 crashed, 502 the backend behind the proxy failed, 503 overloaded or in maintenance, 504 the backend was too slow.
The ones people mix up
401 vs 403: 401 means "who are you?" — authenticate and try again. 403 means "I know who you are and the answer is no". 301 vs 302 vs 307: 301 tells search engines to move the ranking to the new URL and lets browsers cache the redirect forever, so never use it for anything temporary; 302 and 307 are temporary, and 307 additionally promises not to turn a POST into a GET. 502 vs 504: both come from a proxy or load balancer; 502 means the backend answered badly or refused the connection, 504 means it did not answer in time. 404 vs 410: 410 says "gone on purpose", which search engines act on faster.
Unofficial codes
The registry stops at 511, but two families show up constantly. nginx logs 499 when the client hangs up before the response is ready — a client timeout, not a server fault. Cloudflare returns 520–526 when it cannot get a usable response from your origin: 521 the origin refused the connection, 522 the TCP handshake timed out, 524 the origin took over 100 seconds, 525/526 TLS problems. They are included here because searching for them is how most people learn they exist.
To see the status code a URL actually returns, along with its headers and redirect chain, use the HTTP header checker.
Frequently asked questions
What is the difference between 401 and 403?
401 Unauthorized means you are not authenticated — log in or send valid credentials and the request may succeed. 403 Forbidden means you are known but not permitted; logging in again changes nothing.
What causes a 502 Bad Gateway?
A proxy or load balancer (nginx, Cloudflare, an API gateway) could not get a valid response from the server behind it: the backend is down, crashed mid-request, is listening on the wrong port, or returned garbage. It is almost always a backend problem, not the proxy's.
Which redirect should I use, 301 or 302?
301 when the move is permanent — search engines transfer ranking and browsers cache it. 302 (or 307, which keeps the method) for anything temporary: A/B tests, maintenance, login bounces. Using 301 for something temporary is hard to undo because of the caching.
What is a 429 and how do I fix it?
Too Many Requests — you hit a rate limit. The Retry-After header says how long to wait. Fix it by slowing down, batching requests, caching responses, or asking the provider for a higher limit.
Is 418 real?
It comes from an April Fools RFC (2324, "Hyper Text Coffee Pot Control Protocol") and is not in the official registry, but many frameworks implement it and some servers send it to reject bots. Treat it as a joke that occasionally appears in logs.