HTTP Status Codes
Look up any HTTP status code in seconds. Search by number, name or symptom to see what the code means, why it happens, how to fix it and which RFC defines it, including unofficial codes from nginx, Cloudflare, IIS and AWS.
How to use the HTTP Status Codes
- Type a status code such as 404 or 503 in the search box and press Look up (or Enter) to jump straight to it.
- Search by symptom instead, for example redirect, rate limit, cookie or ssl, to find the codes that match.
- Filter by class with the 1xx–5xx tabs, and untick unofficial codes if you only want registered ones.
- Click a code to expand its meaning, common causes and fixes, spec reference and an example status line.
- Download CSV or JSON to reuse the list in documentation, tests or a spreadsheet.
The five classes of HTTP status codes
| Class | Meaning | Most common codes |
|---|---|---|
| 1xx Informational | Interim response; the request is still in progress | 100 Continue, 101 Switching Protocols, 103 Early Hints |
| 2xx Success | The request was received, understood and accepted | 200 OK, 201 Created, 204 No Content, 206 Partial Content |
| 3xx Redirection | Further action, usually following a Location header, is needed | 301, 302, 304 Not Modified, 307, 308 |
| 4xx Client error | The request is wrong or not allowed | 400, 401, 403, 404, 409, 422, 429 |
| 5xx Server error | The server failed to fulfill a valid request | 500, 502, 503, 504 |
The first digit is all a client strictly needs: RFC 9110 says that an unrecognized code is treated as the x00 code of its class, so an unknown 471 is handled like 400 Bad Request.
Redirect codes compared
| Code | Permanent? | Keeps method and body? | Typical use |
|---|---|---|---|
| 301 Moved Permanently | Yes | No (POST may become GET) | Domain moves, HTTP to HTTPS, renamed pages |
| 302 Found | No | No (POST may become GET) | Temporary redirects, login flows |
| 303 See Other | No | No, always GET | After a form submission (Post/Redirect/Get) |
| 307 Temporary Redirect | No | Yes | Temporary moves of API endpoints |
| 308 Permanent Redirect | Yes | Yes | Permanent moves of API endpoints and form targets |
Status codes for REST APIs
A consistent API uses a small, predictable set of codes. A good default mapping:
| Operation | Success | Typical errors |
|---|---|---|
| GET /items/42 | 200 OK (304 if unchanged) | 404 if the item does not exist |
| POST /items | 201 Created with a Location header | 400 malformed JSON, 422 validation failed, 409 duplicate |
| PUT or PATCH /items/42 | 200 OK with the item, or 204 No Content | 412 if If-Match fails, 404, 422 |
| DELETE /items/42 | 204 No Content | 404, or 409 if other records depend on it |
| Long-running job | 202 Accepted plus a status URL | 429 rate limit, 503 overloaded |
| Any endpoint | – | 401 missing or expired token, 403 not permitted, 500 bug |
Tip: always return an error body explaining the problem (for example the application/problem+json format from RFC 9457) and never send 200 OK with an error message inside. Monitoring, caches, retries and search engines all rely on the status code.
Frequently asked questions
What does a 404 error mean?
404 Not Found means the server could not find anything at the requested URL. The link may be mistyped, the page may have moved without a redirect, or it may have been deleted. Fix broken links, add 301 redirects for moved pages, or return 410 Gone if the page was removed on purpose.
What is the difference between 401 and 403?
401 Unauthorized means you are not authenticated: log in or send valid credentials and the request may succeed. 403 Forbidden means the server knows who you are (or does not care) and still refuses; logging in again will not help.
Should I use a 301 or a 302 redirect?
Use 301 (or 308) when a page has moved permanently, such as after a site migration; search engines transfer ranking signals to the new URL. Use 302 (or 307) for temporary moves where the original URL should keep its place in search results. 307 and 308 also guarantee the HTTP method is not changed.
What causes a 502 Bad Gateway error?
A proxy, load balancer or CDN in front of the website got an invalid response from the server behind it. Usually the application crashed, was restarted, or closed the connection. Visitors can retry after a minute; site owners should check the upstream application's logs.
Are codes like 499, 520 or 444 real HTTP status codes?
They are unofficial. They are not in the IANA registry but are used by specific software: 444 and 499 by nginx, 520 to 527 by Cloudflare, 440 and 449 by Microsoft IIS. The tool marks them as unofficial and names the source.
Which status codes are cached by default?
RFC 9110 lists 200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414 and 501 as heuristically cacheable, meaning caches may store them even without explicit freshness headers. Every other code is cached only if Cache-Control or Expires headers allow it.
What happens if a server sends a code that is not registered?
Clients treat it like the x00 code of its class. A client receiving 299 handles it as 200 OK, and an unknown 4xx code is handled as 400 Bad Request. Type any three-digit code to see this explained.