This is a searchable reference to all the standard HTTP response status codes in the IANA registry, from <code>100 Continue</code> to <code>511 Network Authentication Required</code>. Each code comes with a plain-language explanation, advice on when a server or API should send it, the response headers that go with it and a link to the RFC that defines it. Common unofficial codes — nginx's <code>499</code>, Laravel's <code>419</code>, Cloudflare's <code>520</code>–<code>526</code> — are included and clearly marked. Search by number, name or keyword such as "redirect" or "rate limit".
How to look up a status code
- 1Type a code (
404), the start of one (40), a class (4xx), a name (teapot) or a keyword (rate limit, cache, Retry-After). - 2Narrow the list to one class with the 1xx–5xx filters, or hide the unofficial codes.
- 3Select a code — with the mouse or the arrow keys — to see its meaning, when to use it, related headers and the specification.
- 4Copy the code or the full status line, or share the page's URL: it ends in
#404 and opens on that code.
The five classes of status codes
Clients that meet a code they do not recognise treat it as the x00 code of its class, so an unknown 499 is handled like 400 and an unknown 299 like 200. That is why a new code can be introduced without breaking old software.
- 1xx Informational
- Interim responses sent before the final one: 100 Continue, 101 Switching Protocols for WebSockets, 103 Early Hints for preloading.
- 2xx Success
- The request worked. 200 OK is the default; 201 Created and 204 No Content say more precisely what happened.
- 3xx Redirection
- The client must look elsewhere, usually at the URL in the Location header — or, for 304 Not Modified, use its cached copy.
- 4xx Client error
- The request was wrong: malformed, unauthenticated, forbidden, for something that does not exist, or too frequent. Retrying unchanged will not help.
- 5xx Server error
- The request may have been fine but the server, or something behind it, failed. These are often temporary and worth retrying with back-off.
Choosing the right code for an API
Most APIs need only a dozen codes. For success: 200 with a body, 201 with a Location header when something was created, 202 when the work happens later and 204 when there is nothing to return. For client errors: 400 for malformed requests, 422 for well-formed data that fails validation, 401 when credentials are missing or invalid, 403 when they are valid but not sufficient, 404 for unknown resources, 409 for conflicts such as a duplicate email and 429 for rate limiting. For server errors: 500 for bugs, and 502, 503 and 504 for failures in the infrastructure in between.
Whatever the code, return a body that explains it. RFC 9457 "Problem Details" (application/problem+json) gives that body a standard shape with type, title, status and detail fields. Never return 200 with an error inside the body: caches, monitoring and retry logic all read the status code, not your JSON. To format such a body, use the JSON formatter.
Codes that are often confused
- 401 vs 403
- 401 Unauthorized means "I don't know who you are": log in or send a valid token. 403 Forbidden means "I know who you are, and you can't do this".
- 301 vs 302 vs 307 vs 308
- 301 and 308 are permanent and pass search ranking to the new URL; 302 and 307 are temporary. 307 and 308 guarantee the method and body are kept, while browsers turn a POST into a GET on 301 and 302.
- 400 vs 422
- 400 is for requests the server cannot parse at all; 422 for valid JSON whose content breaks the rules, such as a missing required field.
- 404 vs 410
- 404 says nothing is here now; 410 says something was here and was removed on purpose, which makes search engines drop it sooner.
- 502 vs 504
- Both come from a proxy or load balancer. 502 means the upstream answered with something invalid or closed the connection; 504 means it did not answer in time.
- 500 vs 503
- 500 is an unexpected failure, usually a bug. 503 is a known, temporary condition — maintenance or overload — and should carry Retry-After.
Status codes and SEO
Search engines read status codes closely. Use 301 or 308 when a page moves for good, so its ranking moves with it; a 302 tells them the old URL is still the one to index. Serve a real 404 or 410 for missing pages — a "not found" page that returns 200 is a "soft 404" and wastes crawl budget. During maintenance, return 503 with Retry-After so pages are not dropped. Check what crawlers may visit with the robots.txt generator.
Responses with 200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414, 451 and 501 can be cached by browsers and CDNs even without explicit freshness headers, so an accidental 404 or 301 can stick around; set Cache-Control deliberately on these.
Unofficial codes you will see in logs
Some codes are not in the IANA registry but are common in practice. nginx logs 499 when the client hangs up before the response and 444 when it closed a connection without answering. Cloudflare returns 520–526 when it cannot get a good response from the origin server: 521 means the origin refused the connection, 522 that it timed out, 524 that it took over 100 seconds to answer and 525/526 that TLS to the origin failed. Laravel sends 419 when a CSRF token has expired. These are marked "unofficial" in the list, and can be hidden.
- What is an HTTP status code?
- A three-digit number at the start of every HTTP response that tells the client how the request went. The first digit gives the class: 1xx informational, 2xx success, 3xx redirection, 4xx client error and 5xx server error.
- What is the difference between 401 and 403?
- 401 Unauthorized means the request has no valid credentials, so logging in may help. 403 Forbidden means the server knows who you are but you do not have permission, so logging in again will not help.
- Should I use 301 or 302 for a redirect?
- Use 301 (or 308) when the move is permanent, such as a changed URL or a domain migration; search engines transfer the page's ranking to the new address. Use 302 (or 307) when the original URL will come back.
- What does 429 Too Many Requests mean?
- The client is being rate limited. Wait before retrying: the Retry-After header, if present, says how many seconds or until what time. Clients should back off exponentially rather than retry immediately.
- What causes a 502 Bad Gateway error?
- A proxy, load balancer or CDN in front of the site got an invalid response from the server behind it — usually because the application crashed, restarted or closed the connection. The fix is on the server side, in the upstream application's logs.
- What is a 499 status code?
- An nginx-specific code logged when the client closed the connection before nginx could send a response. The client never receives it. Many 499s usually mean the backend is too slow and clients are giving up.
- Is 418 I'm a teapot a real status code?
- It began as an April Fools' joke in RFC 2324 (1998). It is not meant for real use, but because so much software implements it, RFC 9110 reserves 418 so it will never be assigned to anything else.
- How many HTTP status codes are there?
- The IANA registry defines about 63 codes, including a few reserved or deprecated ones such as 306 and 305. Codes from 100 to 599 are possible, and clients treat any unknown code as the x00 code of its class.
