HTTP Status Codes

A searchable reference of HTTP status codes — 200, 301, 404, 500 and more — with plain-language meanings. In your browser.

1xx informational response

100Continue
The client should continue with its request.
101Switching Protocols
The server is switching protocols as requested (e.g. to WebSocket).
102ProcessingFor WebDAV.
The server is processing the request, but no response is available yet.
103Early Hints
Preload hints sent before the final response.

2xx success

200OK
The request succeeded.
201Created
The request succeeded and a new resource was created.
202Accepted
The request was accepted but not yet processed.
203Non-Authoritative Information
The returned metadata is from a copy, not the origin server.
204No Content
Success, but there is no content to return.
205Reset Content
Success; the client should reset the document view (e.g. clear a form).
206Partial Content
The server is delivering part of the resource (range request).
207Multi-StatusFor WebDAV.
The body carries a separate status for each of several sub-requests.
208Already ReportedFor WebDAV.
This collection was already listed earlier in the same response and is not repeated.
226IM Used
The response is the result of instance manipulations applied to the resource (delta encoding).

3xx redirection

300Multiple Choices
The request has multiple possible responses to choose from.
301Moved Permanently
The resource has permanently moved to a new URL.
302Found
The resource is temporarily at a different URL.
303See Other
Follow a GET request to another URL to get the result.
304Not Modified
The cached version is still valid; nothing changed.
305Use Proxy
The requested resource is available only through a proxy, the address for which is in the response. Deprecated.
306Switch Proxy
No longer used — reserved by an abandoned draft and never standardized.
307Temporary Redirect
Temporary redirect that keeps the original method.
308Permanent Redirect
Permanent redirect that keeps the original method.

4xx client error

400Bad Request
The server could not understand the request (malformed syntax).
401Unauthorized
Authentication is required or has failed.
402Payment Required
Reserved for future use; sometimes used by paid APIs.
403Forbidden
The server understood but refuses to authorize the request.
404Not Found
The requested resource does not exist.
405Method Not Allowed
The HTTP method is not allowed for this resource.
406Not Acceptable
No response matches the client’s Accept headers.
407Proxy Authentication Required
You must authenticate with a proxy first.
408Request Timeout
The client took too long to send the request.
409Conflict
The request conflicts with the current state of the resource.
410Gone
The resource is permanently gone with no forwarding address.
411Length Required
The server requires a Content-Length header.
412Precondition Failed
A precondition in the request headers was not met.
413Content Too Large
The request body is larger than the server will accept.
414URI Too Long
The requested URI is longer than the server will accept.
415Unsupported Media Type
The request body’s media type is not supported by the server.
416Range Not Satisfiable
The requested range cannot be served.
417Expectation Failed
The Expect request header could not be met.
418I'm a teapot
An April Fools’ joke code — the server refuses to brew coffee.
421Misdirected Request
The request was sent to a server that cannot produce a response for it.
422Unprocessable Entity
The request was well-formed but has semantic errors (validation).
423LockedFor WebDAV.
The resource is locked (WebDAV).
424Failed DependencyFor WebDAV.
The request failed because an earlier request it depended on failed.
425Too Early
The server is unwilling to risk processing a replayed request.
426Upgrade Required
The client should switch to a different protocol.
428Precondition Required
The server requires the request to be conditional.
429Too Many Requests
The client sent too many requests (rate limited).
431Request Header Fields Too Large
The request’s header fields are too large.
451Unavailable For Legal Reasons
The resource is unavailable for legal reasons (e.g. censorship).

5xx server error

500Internal Server Error
A generic server error with no more specific message.
501Not Implemented
The server does not support the functionality required.
502Bad Gateway
An upstream server returned an invalid response.
503Service Unavailable
The server is temporarily overloaded or down for maintenance.
504Gateway Timeout
An upstream server did not respond in time.
505HTTP Version Not Supported
The HTTP version used in the request is not supported.
506Variant Also Negotiates
Content negotiation is misconfigured: the chosen variant negotiates again, in a circle.
507Insufficient StorageFor WebDAV.
The server cannot store the representation needed (WebDAV).
508Loop DetectedFor WebDAV.
The server detected an infinite loop while processing the request.
510Not Extended
The request needs a protocol extension the server does not support.
511Network Authentication Required
You must authenticate to gain network access (captive portal).

🔒 A static reference — nothing is uploaded.

Look up any HTTP status code

Search by number (like 404) or name (like Not Found) to see what a status code means, colour-coded by category: 1xx informational, 2xx success, 3xx redirection, 4xx client error and 5xx server error. It's a static reference, so nothing is uploaded.

The five categories

2xx means the request worked, 3xx means it was redirected, 4xx means the client made a mistake (like a bad URL), and 5xx means the server failed.

The first digit is the whole story

1xx is "still going", 2xx is "it worked", 3xx is "look elsewhere", 4xx is "you got it wrong" and 5xx is "we got it wrong". That last split is the one that matters in an incident: a wall of 4xx is a client, a crawler or an integration sending something bad, while a wall of 5xx is yours. It is also the line teams cross by accident — returning 200 with an error message in the body makes every monitor, cache and retry policy believe the request succeeded, and is the single most common way a broken endpoint stays invisible.

The pairs people get wrong

301 and 302. A 301 is permanent and browsers cache it hard — often until the profile is cleared, and no header reliably takes it back. Use 302 or 307 while you are still deciding, and 301 only when you mean forever. 401 and 403. 401 means "I do not know who you are, try authenticating"; 403 means "I know exactly who you are and the answer is still no". Sending 401 for a permission problem invites a client into a login loop it can never escape. 404 and 410. 410 says the thing is gone deliberately, which lets a crawler drop it far faster than a 404 will.

Frequently asked questions

What's the difference between 301 and 302?

301 is a permanent redirect (update your links), while 302 is temporary (keep using the original URL).

What does 404 mean?

Not Found — the server could not find the requested resource at that URL.

What does 415 mean?

Unsupported Media Type — the server rejected the request because its Content-Type isn't supported (a common cause of failed POST/upload requests).

What does 500 mean?

Internal Server Error — a generic message that something went wrong on the server side.

301 or 302 — which should I use?

302 (or 307, which preserves the method) unless you are certain the move is permanent. Browsers cache a 301 aggressively and there is no reliable way to un-send it; a wrong 301 can outlive the mistake by months.

What is the difference between 401 and 403?

401 means the request was not authenticated — credentials are missing or invalid, so try again with some. 403 means the request was authenticated and is still refused. Using 401 for a permissions failure sends clients into a login loop.

Is it ever fine to return 200 with an error inside?

Rarely, and only where the protocol on top defines its own status — some RPC styles do. Otherwise it hides failures from every cache, monitor and retry policy in the path, which all read the status line and not your body.

What does 418 mean?

It is the April Fools’ teapot code from 1998, defined in a joke RFC and never a real status. Some servers still implement it; nothing should depend on it.