What's the difference between 401 and 403?

401 means the server doesn't know who you are: you're not logged in, or your token is missing or expired. 403 means it knows who you are and still refuses: you don't have permission.

What's the difference between 502, 503 and 504?

All three come from a proxy, CDN or load balancer in front of the app. 502: the app behind it gave a bad response or none (often it crashed). 503: the service is overloaded or down for maintenance. 504: the app took too long to answer.

Which redirect should I use?

301 or 308 for permanent moves, 302 or 307 for temporary ones. 307 and 308 guarantee the method stays the same, so a POST stays a POST; use 303 to send a browser to a results page after a form.

HTTP status codes

Runs on your device

Every HTTP status code in plain English: what it means, what usually causes it, and how to fix it.

Status code or words

48 status codes

100ContinueInformational · RFC 9110
The server got the request headers and the client may send the body.
Usual cause
A client sent Expect: 100-continue before uploading a large body.
What to do
Nothing; clients handle it automatically.
101Switching ProtocolsInformational · RFC 9110
The server agrees to switch protocol, usually to WebSocket.
Usual cause
A WebSocket handshake (Upgrade: websocket) succeeded.
What to do
Nothing; it's the normal start of a WebSocket connection.
103Early HintsInformational · RFC 8297
Preliminary headers, usually Link preloads, sent before the final response.
Usual cause
The server or CDN lets the browser start loading CSS and fonts early.
What to do
Nothing; it's a performance feature.
200OKSuccess · RFC 9110
The request succeeded.
Usual cause
Normal success.
What to do
Nothing.
201CreatedSuccess · RFC 9110
The request succeeded and created a resource.
Usual cause
A POST or PUT created something; the Location header usually points to it.
What to do
Nothing; read Location for the new resource's URL.
202AcceptedSuccess · RFC 9110
The request was accepted for processing, which hasn't finished.
Usual cause
Asynchronous jobs: exports, video processing, queued work.
What to do
Poll the status URL the API gives you, or wait for its webhook.
204No ContentSuccess · RFC 9110
Success, with no body.
Usual cause
A DELETE, or a save that returns nothing.
What to do
Nothing; don't try to parse a body.
206Partial ContentSuccess · RFC 9110
Only the requested byte range is returned.
Usual cause
Video seeking, resumable downloads (a Range request).
What to do
Nothing; it's how streaming and resuming work.
301Moved PermanentlyRedirection · RFC 9110
The resource has a new permanent URL, given in Location.
Usual cause
A site moved pages, switched to HTTPS, or changed domain.
What to do
Update links and bookmarks to the new URL. Browsers may change POST to GET when following it; use 308 to prevent that.
302FoundRedirection · RFC 9110
The resource is temporarily at another URL.
Usual cause
Login redirects, A/B tests, temporary moves.
What to do
Follow it, but keep using the original URL. Use 307 when the method must not change.
303See OtherRedirection · RFC 9110
Go and GET another URL for the result.
Usual cause
After a form POST, so refreshing doesn't resubmit it.
What to do
Follow it with GET; it's the intended pattern.
304Not ModifiedRedirection · RFC 9110
The cached copy is still valid; no body is sent.
Usual cause
The browser sent If-None-Match or If-Modified-Since and nothing changed.
What to do
Nothing; it's caching working as designed.
307Temporary RedirectRedirection · RFC 9110
Temporarily at another URL; repeat the same method and body there.
Usual cause
Temporary moves where a POST must stay a POST, or HSTS upgrades in browsers.
What to do
Follow it; the method is preserved.
308Permanent RedirectRedirection · RFC 9110
Permanently at another URL; repeat the same method and body there.
Usual cause
Permanent moves of API endpoints and form targets.
What to do
Update the URL; the method is preserved.
400Bad RequestClient error · RFC 9110
The server can't process the request because something in it is malformed.
Usual cause
Invalid JSON, missing or wrong fields, a malformed query string, an oversized cookie.
What to do
Check the request body and parameters against the API's documentation; the response body often names the problem. In a browser, clearing the site's cookies often fixes it.
401UnauthorizedClient error · RFC 9110
Authentication is missing or invalid.
Usual cause
No API key or token, an expired session, or a wrong password.
What to do
Log in again, or send a valid Authorization header. Despite the name, it's about who you are, not what you're allowed.
402Payment RequiredClient error · RFC 9110
Reserved; some APIs use it for billing problems.
Usual cause
An API quota or plan has run out, or a payment failed.
What to do
Check your account's billing or plan.
403ForbiddenClient error · RFC 9110
The server understood who you are and refuses access.
Usual cause
Missing permission, an IP or country block, a firewall or bot rule, wrong file permissions on the server.
What to do
Check the account's role or permissions. If you own the site, check firewall and WAF rules and file permissions.
404Not FoundClient error · RFC 9110
Nothing exists at this URL, or the server won't say that it does.
Usual cause
A typo, a deleted or moved page without a redirect, a broken link.
What to do
Check the URL. If you own the site, add a 301 redirect from old URLs.
405Method Not AllowedClient error · RFC 9110
The URL exists but doesn't accept this method.
Usual cause
A POST to a GET-only endpoint, or the reverse.
What to do
Use a method listed in the response's Allow header.
406Not AcceptableClient error · RFC 9110
The server can't produce a format the Accept header allows.
Usual cause
A strict Accept header, or a security rule rejecting the request.
What to do
Loosen the Accept header, for example to application/json or */*.
408Request TimeoutClient error · RFC 9110
The server gave up waiting for the client to finish sending.
Usual cause
A slow or interrupted connection while uploading.
What to do
Retry; check the network if it keeps happening.
409ConflictClient error · RFC 9110
The request conflicts with the resource's current state.
Usual cause
Editing something someone else changed, creating a duplicate, a version mismatch.
What to do
Fetch the latest version, resolve the conflict and retry.
410GoneClient error · RFC 9110
The resource was removed on purpose and won't come back.
Usual cause
Deleted content or retired API versions.
What to do
Remove links to it; search engines drop 410 pages faster than 404s.
411Length RequiredClient error · RFC 9110
The server needs a Content-Length header.
Usual cause
A body sent without its length.
What to do
Send Content-Length with the body.
412Precondition FailedClient error · RFC 9110
A condition in the request headers wasn't met.
Usual cause
If-Match with an outdated ETag: someone else changed the resource.
What to do
Fetch the current version and its ETag, then retry.
413Content Too LargeClient error · RFC 9110
The request body is larger than the server accepts.
Usual cause
An upload over the server's or proxy's size limit.
What to do
Send a smaller file or raise the limit on the server (for example client_max_body_size in nginx).
414URI Too LongClient error · RFC 9110
The URL is longer than the server will process.
Usual cause
Huge query strings, often data that belongs in a POST body.
What to do
Move the data into the request body.
415Unsupported Media TypeClient error · RFC 9110
The server doesn't accept the body's format.
Usual cause
Wrong or missing Content-Type, such as sending JSON without application/json.
What to do
Set Content-Type to a format the API accepts.
416Range Not SatisfiableClient error · RFC 9110
The requested byte range is outside the file.
Usual cause
Resuming a download of a file that changed or shrank.
What to do
Restart the download from the beginning.
418I'm a teapotClient error · RFC 2324, RFC 9110
An April Fools' joke code; HTTP reserves it so it isn't reused.
Usual cause
Joke endpoints, or some bot-blocking systems.
What to do
If it isn't a joke, the server is refusing automated requests.
421Misdirected RequestClient error · RFC 9110
The request reached a server that can't answer for this host.
Usual cause
Reused HTTP/2 connections across hosts with shared certificates.
What to do
Retry; browsers do this automatically. If you run the server, check TLS and virtual host settings.
422Unprocessable ContentClient error · RFC 9110
The request is well-formed but its content fails validation.
Usual cause
Valid JSON with invalid values: a bad email, a missing required field.
What to do
Fix the fields listed in the response's error details.
425Too EarlyClient error · RFC 8470
The server won't risk processing a request that might be replayed.
Usual cause
Requests sent in TLS 1.3 early data.
What to do
Retry; clients normally do this automatically.
426Upgrade RequiredClient error · RFC 9110
The server requires a different protocol.
Usual cause
A server that needs TLS or a newer HTTP version.
What to do
Use the protocol named in the Upgrade header.
428Precondition RequiredClient error · RFC 6585
The server requires a conditional request.
Usual cause
APIs that demand If-Match to prevent lost updates.
What to do
Fetch the resource's ETag and send it in If-Match.
429Too Many RequestsClient error · RFC 6585
Rate limited: too many requests in a time window.
Usual cause
Hitting an API's limit, a retry loop, or scraping too fast.
What to do
Wait for the time in Retry-After, then retry with exponential backoff and fewer parallel requests.
431Request Header Fields Too LargeClient error · RFC 6585
Headers, usually cookies, are too big.
Usual cause
A build-up of cookies on the domain.
What to do
Clear the site's cookies; if you run the site, set fewer or smaller cookies.
451Unavailable For Legal ReasonsClient error · RFC 7725
Blocked for legal reasons, such as a court order or sanctions.
Usual cause
Content blocked in your country.
What to do
Nothing technical; the response may explain the legal demand.
500Internal Server ErrorServer error · RFC 9110
The server failed while handling the request.
Usual cause
An unhandled exception or bug in server code.
What to do
If it's your server, check the application logs for the stack trace. Otherwise retry later and report it.
501Not ImplementedServer error · RFC 9110
The server doesn't support the functionality needed.
Usual cause
An unknown method, or a feature not built yet.
What to do
Use a supported method or endpoint.
502Bad GatewayServer error · RFC 9110
A proxy or gateway got an invalid response from the server behind it.
Usual cause
The app server crashed, isn't running, or closed the connection; a wrong upstream address.
What to do
Check that the application behind the proxy, CDN or load balancer is up, and read its logs.
503Service UnavailableServer error · RFC 9110
The server can't handle the request right now.
Usual cause
Overload, maintenance, or no healthy instances behind a load balancer.
What to do
Retry after the time in Retry-After. If it's your service, check capacity and health checks.
504Gateway TimeoutServer error · RFC 9110
A proxy or gateway didn't get a response from the server behind it in time.
Usual cause
A slow database query or upstream API, or a function exceeding its time limit.
What to do
Find the slow step and speed it up, move long work to a background job, or raise the timeout.
505HTTP Version Not SupportedServer error · RFC 9110
The server doesn't support the request's HTTP version.
Usual cause
Very old or very new clients against a limited server.
What to do
Use HTTP/1.1 or HTTP/2.
507Insufficient StorageServer error · RFC 4918
The server can't store what's needed to complete the request.
Usual cause
A full disk on the server, mostly WebDAV.
What to do
Free disk space on the server.
508Loop DetectedServer error · RFC 5842
The server found an infinite loop while processing.
Usual cause
Circular references in WebDAV.
What to do
Fix the circular reference.
511Network Authentication RequiredServer error · RFC 6585
You need to sign in to the network first.
Usual cause
Hotel, airport or café Wi-Fi with a captive portal.
What to do
Open any website in a browser to reach the network's login page.

How to use HTTP status codes

Type a status code, a class such as 4xx, or words such as timeout.
Read what the code means and what usually causes it.
Follow the suggested fix, starting with the layer that sent the response.

What the error actually means

Every response from a web server carries a three-digit status code. The first digit gives the class: 1xx informational, 2xx success, 3xx redirection, 4xx a problem with the request, and 5xx a problem on the server. This reference explains each code in plain English, with the situation that usually causes it and what to do next, whether you're debugging an API, running a website or just trying to understand an error page.

Search by number, by class such as 4xx, or by words such as timeout, cookies or redirect. Codes follow RFC 9110, the current HTTP standard, with the RFCs for extension codes such as 429 noted on each.

The ones people search for most

404 Not Found means nothing is at that address, usually a typo or a page that moved without a redirect. 403 Forbidden means the server knows who you are and refuses anyway; 401 means it doesn't know who you are. 429 Too Many Requests is rate limiting: wait for the time in the Retry-After header and slow down.

502 Bad Gateway, 503 Service Unavailable and 504 Gateway Timeout all come from a proxy, CDN or load balancer in front of an application: 502 when the application gave a bad answer or none, 503 when it's overloaded or in maintenance, and 504 when it took too long. The fix is in the application behind it, so start with its logs.

Redirects, briefly

301 and 308 are permanent, 302 and 307 temporary. 307 and 308 promise that a POST stays a POST, while browsers may turn a 301 or 302 into a GET. 303 sends a browser to a results page after a form submission, so refreshing doesn't submit it twice. For moving pages on a website, a 301 tells search engines to transfer the old page's ranking to the new address.

Debugging tips

Look at the response body as well as the code: APIs usually explain a 400 or 422 in a JSON error message. Check which layer answered, since a 403 from a CDN firewall needs a different fix from a 403 from your application.

Questions

What's the difference between 401 and 403?: 401 means the server doesn't know who you are: you're not logged in, or your token is missing or expired. 403 means it knows who you are and still refuses: you don't have permission.
What's the difference between 502, 503 and 504?: All three come from a proxy, CDN or load balancer in front of the app. 502: the app behind it gave a bad response or none (often it crashed). 503: the service is overloaded or down for maintenance. 504: the app took too long to answer.
Which redirect should I use?: 301 or 308 for permanent moves, 302 or 307 for temporary ones. 307 and 308 guarantee the method stays the same, so a POST stays a POST; use 303 to send a browser to a results page after a form.