HTTP Status Codes Reference
All HTTP status codes — what they mean, when to use them, and real-world examples. Search by code, name, or description.
Server received request headers, client should proceed.
Large file uploads — server says 'keep going'.
Server agrees to switch protocols as requested by client.
Upgrading HTTP to WebSocket.
Server has received and is processing the request, no response yet.
Long-running WebDAV operations.
Preload resources while the server prepares the main response.
Hint browser to preload CSS/fonts before HTML arrives.
Request succeeded.
Standard success response for GET, POST, PUT.
Request succeeded and a new resource was created.
POST that creates a new record (return its URL in Location header).
Request accepted for processing, not yet complete.
Async jobs — 'we got it, processing in background'.
Response is from a proxy, not the origin server.
Caching proxies that modify content.
Request succeeded but no body to return.
DELETE or PUT with no response body needed.
Tell client to reset the document view.
After form submission — clear the form.
Partial resource returned, in response to a range request.
Video streaming, resumable downloads (Range header).
Resource permanently moved to new URL.
SEO-safe redirects. Browsers cache this forever.
Resource temporarily at different URL.
Temporary redirects. Not cached by default.
Redirect to a GET request after a POST.
Post/Redirect/Get pattern — prevents form re-submission.
Resource hasn't changed, use cached version.
ETag/If-None-Match cache validation.
Redirect, but keep the HTTP method (POST stays POST).
Temporary redirect where method must be preserved.
Permanent redirect, keep the HTTP method.
Permanent redirect where POST must stay POST.
Server cannot understand request due to invalid syntax.
Malformed JSON, missing required fields, invalid params.
Client must authenticate to get the resource.
Missing or invalid auth token/credentials.
Client authenticated but not authorized.
Logged in but lacks permission. Don't reveal if resource exists.
Resource not found or server hides its existence.
Unknown URL, deleted resource, or hidden 403.
HTTP method not supported for this resource.
POST on a read-only endpoint. Include Allow header.
Server can't produce a response in the format requested.
Accept header mismatch — client wants XML, server only does JSON.
Server timed out waiting for request.
Client took too long to send request body.
Request conflicts with current state of resource.
Duplicate create, version conflict, edit collision.
Resource permanently deleted, no forwarding address.
Intentionally removed content. Stronger signal than 404.
Server requires Content-Length header.
PUT/POST without Content-Length.
Request body exceeds server limit.
File upload too big.
URL is too long for the server to process.
Excessively long query strings.
Unsupported Content-Type in request.
Sending XML to an endpoint that only accepts JSON.
Requested range is outside the resource's bounds.
Invalid Range header in download request.
Server refuses to brew coffee because it is a teapot.
April Fools RFC 2324. Used as an Easter egg by Google, Cloudflare.
Request is well-formed but semantically invalid.
Validation errors — fields present but fail business rules.
Server unwilling to process request that might be replayed.
TLS early data (0-RTT) anti-replay protection.
Client has sent too many requests in a given time.
Rate limiting. Include Retry-After header.
Resource blocked due to legal demand.
GDPR removal, government censorship, court order.
Generic server-side error.
Unhandled exception, crashed handler, bug.
Server does not support the request method.
Method recognized but not implemented yet.
Upstream server returned invalid response.
Reverse proxy got garbage from backend.
Server temporarily unavailable — maintenance or overload.
Planned downtime or overload. Include Retry-After.
Upstream server didn't respond in time.
Backend too slow. Proxy timed out waiting.
HTTP version used in the request is not supported.
Rare — very old or malformed clients.
Server is out of storage to complete the request.
WebDAV — disk full.
Client must authenticate to gain network access.
Captive portals (hotel Wi-Fi login pages).
Frequently Asked Questions
- What is the difference between 401 and 403?
- 401 means the client is not authenticated — they need to log in first. 403 means they are authenticated but don't have permission. A 401 says 'who are you?' while a 403 says 'I know who you are, but you can't do this'.
- When should I use 404 vs 410?
- Use 404 when a resource doesn't exist or you want to hide its existence. Use 410 (Gone) when a resource was deliberately removed and you want search engines to de-index it permanently.
- What is the difference between 301 and 302?
- 301 is a permanent redirect — browsers and search engines cache it and update their records. 302 is temporary — no caching, used when a resource might return. Use 301 for SEO redirects, 302 for login redirects.
- Why does 429 matter for APIs?
- 429 Too Many Requests is the standard way to communicate rate limiting. You should always include a Retry-After header so clients know when to try again. Without it, clients may immediately retry and make the overload worse.
- What does 503 mean vs 502?
- 502 Bad Gateway means your server got a bad/no response from an upstream service (e.g. the app crashed). 503 Service Unavailable means your server is deliberately not accepting requests — maintenance or overload.