Skip to content
Free tool

HTTP Status Codes: List & Meanings

A searchable list of HTTP status codes: enter 404, 403, 500, 502 or “redirect” to learn what the code means, what causes it and how to fix it. 70 codes from 100 to 526, with copyable nginx and Apache examples, Cloudflare errors 520 to 526, and nginx codes 444 and 499. Free, with no sign-up—searches run entirely in your browser.

Built by Dimitri Heissler

Running your own project? Put your website on fast web hosting.

View web hosting

Searches numbers, names, explanations, causes, and configuration examples, such as “timeout” or “client_max_body_size”.

Frequently searched:

70 of 70 status codes

Meaning

The server received the request headers and has no objections. The client may send the body. This is part of the “Expect: 100-continue” header, which lets a client ask whether the server will accept a large upload before sending it.

See also:
Defined in RFC 9110

Meaning

The server switches protocols at the client's request, for example from HTTP to WebSocket. The client sent an “Upgrade” header for this.

See also:
Defined in RFC 9110

Meaning

The server is still processing the request and has not completed it. This code comes from WebDAV and prevents a timeout during long operations. It is considered obsolete and is rarely seen.

Defined in RFC 2518

Meaning

The server sends early hints, such as “Link” headers for stylesheets or scripts, while it prepares the actual response. The browser can start loading those files. This is a hint, not an error.

Defined in RFC 8297

Meaning

The request succeeded. For GET, the response contains the requested resource; for POST, it contains the result of the action. This is the normal response from any working page.

For search engine optimization: A 200 only means the server responded, not that the content is correct. An error page served with a 200 is called a “soft 404” and confuses search engines.
See also:
Defined in RFC 9110

Meaning

The request succeeded and created a new resource. This is typical for a POST request to an API. The “Location” header gives the address of the new resource.

See also:
Defined in RFC 9110

Meaning

The server accepted the request but has not finished processing it. It will provide the result later, for example through a status check or webhook. Typical for background jobs.

See also:
Defined in RFC 9110

Meaning

The request succeeded, but the data came from a proxy rather than directly from the origin server. The proxy may have modified it. Rarely seen.

Defined in RFC 9110

Meaning

The request succeeded, but the response intentionally has no body. This is common for DELETE or PUT requests and CORS preflight requests (OPTIONS). If you want to read the response as JSON, you need to handle the empty body.

See also:
Defined in RFC 9110

Meaning

The request succeeded. The client should reset the view, for example by clearing a form. The response has no body. Rarely used.

Defined in RFC 9110

Meaning

The server returns only the requested part of a file because the client sent a “Range” header. Used for video streaming, resumed downloads and large files.

See also:
Defined in RFC 9110

Meaning

The response contains multiple status codes for multiple sub-operations, in XML. This code comes from WebDAV and appears in calendar, contact, and file synchronization.

Defined in RFC 4918

Meaning

The members of a WebDAV binding were already listed in an earlier part of the same response and will not be listed again. Very rare.

Defined in RFC 5842

Meaning

The server responded with delta encoding: The response is the result of one or more instance manipulations applied to the current resource. Not used in practice.

Defined in RFC 3229

Meaning

The request has several possible responses, such as the same file in multiple formats or languages. The client or user should choose one. Rarely used in practice.

See also:
Defined in RFC 9110

Meaning

Permanent redirect: The resource has a new address, specified in the “Location” header. Browsers and search engines should use only the new URL from now on.

Common causes

  • Domain or URL migration, such as from http to https or from www to the root domain
  • A page was renamed or moved
  • A redirect rule in nginx, Apache, or the CMS takes effect

How to fix it

  • Link directly to the destination URL so no redirect is needed.
  • Reduce redirect chains (A, B, C) to a single step.
  • For a redirect loop (ERR_TOO_MANY_REDIRECTS), check the http/https and www rules against each other. The server and CMS often conflict.
  • Browsers cache 301 redirects for a long time. Test changes in an incognito window or with curl -I.

Configuration and commands (examples)

nginx
return 301 https://example.com$request_uri;
Apache
Redirect 301 /alte-seite https://example.com/neue-seite
For search engine optimization: A 301 passes the old URL's ranking signals to the new one. Use it for every permanent move and avoid redirect chains.
See also:
Defined in RFC 9110

Meaning

Temporary redirect: The resource is temporarily available at another address. The client should follow the “Location” header for this request but continue using the original URL in the future. Some clients change a POST to a GET in the process.

Common causes

  • Temporary redirect, for example for a campaign or maintenance
  • Login redirect to a sign-in page
  • Language or country redirect
  • Set incorrectly even though the move is permanent

How to fix it

  • Use 301 or 308 for permanent redirects; otherwise, search engines will keep the old URL.
  • To preserve the method, use 307 (temporary) or 308 (permanent).

Configuration and commands (examples)

nginx
return 302 https://example.com/sommer-angebot;
Apache
Redirect 302 /angebot https://example.com/sommer-angebot
For search engine optimization: With a 302, the old URL stays in the index as long as the redirect is considered temporary. If you use it for a permanent move, rankings transfer only slowly.
See also:
Defined in RFC 9110

Meaning

Redirect with GET: The client should retrieve the result at another URL using GET. Typically used after a POST (Post/Redirect/Get) so reloading the page does not resubmit the form.

See also:
Defined in RFC 9110

Meaning

The resource has not changed since the last request. The server sends no body; the browser uses its cached copy. The browser sent “If-None-Match” (ETag) or “If-Modified-Since” with the request. This saves bandwidth and speeds up the page.

See also:
Defined in RFC 9110

Meaning

A temporary redirect like 302, but the HTTP method and body remain unchanged when following the redirect: a POST stays a POST.

Common causes

  • Chrome shows “307 Internal Redirect” in developer tools for HSTS redirects from http to https, even though the server sent nothing
  • A server temporarily redirects an API request and wants to preserve the method

How to fix it

  • If the redirect is permanent, use 308 instead of 307.

Configuration and commands (examples)

nginx
return 307 https://example.com$request_uri;
Apache
Redirect 307 /alt https://example.com/neu
See also:
Defined in RFC 9110

Meaning

Permanent redirect like 301, but the HTTP method and body remain unchanged: a POST stays a POST. Suitable for permanent API moves and forms that must retain their data.

Configuration and commands (examples)

nginx
return 308 https://example.com$request_uri;
Apache
Redirect 308 /alt https://example.com/neu
For search engine optimization: For search engines, 308 behaves like 301 and transfers rankings to the new address.
See also:
Defined in RFC 9110

Meaning

The server does not understand the request because it is malformed: invalid syntax, broken headers or an oversized cookie. From the server's perspective, the error is on the client side.

Common causes

  • Invalid characters or an incorrectly encoded URL, such as a space or a % without two hexadecimal digits
  • Cookies that are too large or corrupted; shown as “Request Header Or Cookie Too Large” in nginx
  • Invalid JSON body or missing required fields in an API request
  • Incorrect Host or Content-Length headers, often caused by a proxy

How to fix it

  • Clear the domain's cookies in your browser and reload the page.
  • Check the URL and encode special characters, for example with the URL Encoder.
  • Compare the request body with the API documentation.
  • For oversized headers: increase the server's buffer sizes.

Configuration and commands (examples)

nginx
large_client_header_buffers 4 16k;
See also:
Defined in RFC 9110

Meaning

The request requires valid authentication. The client has not logged in or its credentials are invalid. The server sends a “WWW-Authenticate” header specifying the expected method. The name is misleading: it means “not authenticated,” not “not authorized” (that's 403).

Common causes

  • Missing or expired token, password, or API key
  • Incorrect Authorization header, such as a missing “Bearer” before the token
  • HTTP Basic authentication (.htpasswd) for the page or directory

How to fix it

  • Check the credentials and token expiration time.
  • Check the format of the Authorization header.
  • For Basic Auth: check the user in .htpasswd and the file path in the configuration.

Configuration and commands (examples)

nginx
auth_basic "GeschĂĽtzter Bereich";
auth_basic_user_file /etc/nginx/.htpasswd;
Apache
AuthType Basic
AuthName "GeschĂĽtzter Bereich"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
See also:
Defined in RFC 9110

Meaning

Reserved for future payment systems and never standardized. Some services use it anyway, for example when a subscription has expired or an API quota needs to be paid for.

How to fix it

  • Check the invoice or subscription status with the provider.
  • Read the service’s API documentation to find out what it means.
See also:
Defined in RFC 9110

Meaning

The server understands the request but refuses it. Unlike with 401, logging in again usually will not help: This identity or address is not allowed access.

Common causes

  • File permissions or ownership are incorrect; the web server user cannot read the file
  • The directory has no index document, and directory listing is disabled
  • IP block, firewall or WAF rule, or geoblocking
  • A rule in .htaccess or the nginx configuration blocks access (deny all, Require all denied)
  • A security module such as ModSecurity or Fail2ban blocks the request

How to fix it

  • Check permissions: directories are usually 755, files 644, and ownership should match the web server user. The CHMOD calculator converts the numbers.
  • Create an index file (index.html, index.php) or set the index directive.
  • Read the web server’s error log for the exact reason, such as “directory index of … is forbidden”.
  • Check IP blocks and WAF rules.

Configuration and commands (examples)

Shell
namei -l /var/www/html/index.html
nginx
index index.html index.php;
Apache
<Directory /var/www/html>
    Require all granted
</Directory>
See also:
Defined in RFC 9110

Meaning

The server is reachable but does not recognize the requested address. The resource was not found. The server does not say whether it never existed or is only temporarily missing.

Common causes

  • Typo or outdated link
  • Page deleted, moved, or renamed without a redirect
  • Incorrect document path in the web server (root or alias), or incorrect capitalization—Linux is case-sensitive
  • Missing rewrite rules, for example for WordPress permalinks or a single-page app
  • The file was not uploaded during deployment

How to fix it

  • Check the path and file name, including capitalization.
  • Set try_files in nginx so permalinks and single-page apps work: try_files $uri $uri/ /index.php?$args; or /index.html.
  • Redirect moved pages to the new address with a 301 redirect.
  • Set up a custom 404 page with search and links.

Configuration and commands (examples)

nginx
error_page 404 /404.html;
Apache
ErrorDocument 404 /404.html
For search engine optimization: Individual 404 pages do not hurt rankings. Pages with backlinks or traffic matter: redirect them with a 301. Avoid serving an error page with a 200 status (“soft 404”).
See also:
Defined in RFC 9110

Meaning

The resource exists, but not for this HTTP method (GET, POST, PUT, DELETE, and so on). The response must include an “Allow” header listing the permitted methods.

Common causes

  • POST to a route that only accepts GET, or vice versa
  • nginx responds to a POST request for a static file with 405
  • A 301 or 302 redirect changed the POST to a GET
  • Web servers or WAFs block methods such as PUT and DELETE

How to fix it

  • Read the “Allow” header for the permitted methods.
  • Check the route and controller in the application.
  • Use 307 or 308 instead of 301 or 302 if the method must be preserved during the redirect.
  • Use the final https URL directly so a redirect does not change the method.
See also:
Defined in RFC 9110

Meaning

The server cannot provide a response in a format allowed by the client's “Accept” headers, such as a media type, language or character set. Some web application firewalls (ModSecurity) also block requests with this code.

Common causes

  • The Accept header requests only application/xml, for example, but the server only serves JSON
  • A ModSecurity rule flagged the request as suspicious, often because a script has no User-Agent

How to fix it

  • Adjust the Accept-Header or leave it out.
  • For ModSecurity, read the audit log and check the rule that triggered it.
See also:
Defined in RFC 9110

Meaning

Like 401, but authentication is required by a proxy server, not the destination server. The proxy sends the “Proxy-Authenticate” header.

Common causes

  • A company or school proxy requires a login
  • Incorrect proxy credentials in the system settings or curl

How to fix it

  • Enter the proxy credentials, for example with curl using -x benutzer:passwort@proxy:port.
  • Ask your IT department or proxy provider for the correct credentials.
See also:
Defined in RFC 9110

Meaning

The server waited too long for the client's complete request and closed the connection.

Common causes

  • Slow or unstable client connection
  • A large upload fails
  • A proxy or load balancer closes connections too soon
  • The browser opened a connection in advance but never used it

How to fix it

  • Check the connection and retry the request.
  • Increase the timeouts on the server.
  • For uploads: reduce the file sizes or upload the files in parts.

Configuration and commands (examples)

nginx
client_header_timeout 60s;
client_body_timeout 60s;
Apache
RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500
See also:
Defined in RFC 9110

Meaning

The request conflicts with the current state of the resource, such as when changes happen simultaneously or an entry already exists. The client can resolve the conflict and try again.

Common causes

  • A unique value already exists, such as an email address, username, or domain name
  • Two users change the same resource; the version no longer matches
  • The resource cannot be changed or deleted in its current state.

How to fix it

  • Reload the current state and apply your change again.
  • Read the response body: Good APIs describe the conflict precisely there.
See also:
Defined in RFC 9110

Meaning

The resource once existed, was deliberately removed, and will not return. Unlike 404, this is the server saying it is permanently gone.

Common causes

  • The content was intentionally removed, such as an expired offer
  • A server rule returns 410 for old URLs

How to fix it

  • If there's a replacement, redirect to it with a 301.
  • Deliberately return 410 for deleted URLs that will never come back.

Configuration and commands (examples)

nginx
location = /alte-seite {
    return 410;
}
Apache
Redirect gone /alte-seite
For search engine optimization: A 410 clearly tells search engines that the page was intentionally removed. Google treats 404 and 410 similarly, though, so the difference is small.
See also:
Defined in RFC 9110

Meaning

The server requires a “Content-Length” header, which is missing from the request. It accepts the body only if its length is known.

Common causes

  • A client sends the body in chunks to a server that doesn't accept chunked transfer
  • A script or proxy omits the header

How to fix it

  • Set Content-Length or use an HTTP client that sends the header automatically.
  • Check the proxy settings for request buffering.
See also:
Defined in RFC 9110

Meaning

A condition in the request header (If-Match, If-Unmodified-Since, and so on) has not been met. The server therefore does not make the change. This prevents changes from being overwritten.

Common causes

  • The resource has changed since the client loaded the ETag.
  • Outdated ETag in If-Match

How to fix it

  • Reload the resource, get the new ETag, and submit the change again.
See also:
Defined in RFC 9110

Meaning

The request body is larger than the server accepts. This is common with file uploads. This code was previously called “Payload Too Large” and, before that, “Request Entity Too Large”.

Common causes

  • nginx: client_max_body_size defaults to just 1 MB
  • Apache: LimitRequestBody is set
  • PHP: upload_max_filesize or post_max_size is too small
  • An upstream CDN or proxy limits the size

How to fix it

  • Increase the limit in the configuration and reload the server (nginx -s reload).
  • Increase upload_max_filesize and post_max_size in php.ini. post_max_size must be at least as large as upload_max_filesize.
  • Check every stage of the chain: CDN, proxy, web server, and PHP. The lowest limit wins.

Configuration and commands (examples)

nginx
client_max_body_size 50M;
Apache
LimitRequestBody 52428800
See also:
Defined in RFC 9110

Meaning

The URL is longer than the server can process. This usually points to an application error, not a real address.

Common causes

  • Very many parameters in a GET request
  • A redirect loop adds more parameters on every pass
  • Large amounts of data are transferred via URL instead of POST

How to fix it

  • Send large amounts of data via POST.
  • Fix the redirect loop.
  • Increase the server limit if needed.

Configuration and commands (examples)

nginx
large_client_header_buffers 4 16k;
Apache
LimitRequestLine 16384
See also:
Defined in RFC 9110

Meaning

The server does not recognize the format of the request body (“Content-Type” header). For example, it only processes JSON but receives form data.

Common causes

  • The Content-Type header is missing or incorrect, for example application/json instead of text/plain
  • The server expects multipart/form-data for uploads

How to fix it

  • Set Content-Type to match the body.
  • Read the API documentation.
See also:
Defined in RFC 9110

Meaning

The requested range (“Range” header) is outside the file. The server reports the actual size in “Content-Range”.

Common causes

  • A download is resumed from an offset, but the file has shrunk or been replaced
  • A faulty download manager

How to fix it

  • Delete the partial download and start over.
See also:
Defined in RFC 9110

Meaning

The server cannot meet the expectation in the “Expect” header. Usually this is “100-continue”, which a proxy or server does not support.

Common causes

  • An old proxy or server without Expect support
  • curl automatically sends Expect: 100-continue for large POST requests

How to fix it

  • Disable the header in curl with -H 'Expect:'.
  • Update the proxy.

Configuration and commands (examples)

Shell
curl -H 'Expect:' -d @datei.json https://example.com/api
See also:
Defined in RFC 9110

Meaning

An April Fools' joke from RFC 2324 (Hyper Text Coffee Pot Control Protocol): a teapot refuses to brew coffee. The code is reserved and is used in practice as a joke or to block bots.

Defined in RFC 2324

Meaning

The request was sent to a server that cannot respond for this combination of scheme and host. This occurs with HTTP/2 when a browser reuses a connection for multiple hostnames.

Common causes

  • Multiple domains on one IP with a shared certificate but different configurations for each host
  • SNI and Host header do not match

How to fix it

  • Standardize certificates and virtual hosts for the affected domains.
  • Use curl --resolve to check which host responds.
See also:
Defined in RFC 9110

Meaning

The server understands the request and its format, but the content is invalid, for example because a required field is missing or a value is outside the allowed range. This code was formerly called “Unprocessable Entity”. Many frameworks use it for validation errors.

Common causes

  • Validation fails, for example because of the email format, length or a required field
  • A logical error, such as an end date before the start date

How to fix it

  • Read the response body for the fields and error messages.
  • Check the input against the API documentation.
See also:
Defined in RFC 9110

Meaning

The resource is locked, for example because someone checked it out for editing via WebDAV.

How to fix it

  • Release the lock (UNLOCK) or wait until the other user is finished.
See also:
Defined in RFC 4918

Meaning

The request failed because another request it depends on failed. This code comes from WebDAV and is also used by orchestration tools.

See also:
Defined in RFC 4918

Meaning

The server refuses to process a request that could be replayed (replay attack). This occurs with TLS 1.3 Early Data (0-RTT).

Defined in RFC 8470

Meaning

The server requires a different protocol, specified in the “Upgrade” header. For example, a request uses HTTP/1.1 but the server requires TLS or HTTP/2.

Common causes

  • Outdated TLS version
  • The API is only accessible via WebSocket or HTTPS

How to fix it

  • Update the client and library.
  • Send the request using the required protocol.
See also:
Defined in RFC 9110

Meaning

The server requires a condition (If-Match) to prevent an outdated version from being overwritten accidentally.

Common causes

  • A PUT without If-Match on a protected resource

How to fix it

  • Get the resource's ETag and set it in the If-Match header.
See also:
Defined in RFC 6585

Meaning

The client sent too many requests within a given period (rate limiting). The “Retry-After” header indicates when it may try again.

Common causes

  • API or login limit exceeded, for example due to a loop in a script
  • A bot, crawler, or scraper is generating heavy load
  • Brute-force protection (Fail2ban, WAF) is kicking in
  • Multiple users share one IP address (NAT, VPN) and are counted together

How to fix it

  • Wait for the time specified by Retry-After, then retry with increasing delays (exponential backoff).
  • Batch requests and cache responses.
  • For operators: Set limits per IP or API key and respond with 429; nginx uses 503 by default.
  • Allow legitimate crawlers.

Configuration and commands (examples)

nginx
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

server {
    location /api/ {
        limit_req zone=api burst=20 nodelay;
        limit_req_status 429;
    }
}
For search engine optimization: Googlebot treats 429 as a server error and crawls more slowly. Set limits so search engines are not consistently affected.
See also:
Defined in RFC 6585

Meaning

The request headers are too large, either individually or in total. The most common cause is too many cookies or cookies that are too large.

Common causes

  • Accumulated cookies (tracking, sessions) on a domain
  • A very long Authorization header, such as a large JWT
  • A redirect loop keeps adding more cookies

How to fix it

  • Clear the domain's cookies.
  • Increase the server's header buffers.
  • Keep JWTs and headers small.

Configuration and commands (examples)

nginx
large_client_header_buffers 4 16k;
Apache
LimitRequestFieldSize 16384
See also:
Defined in RFC 6585

Meaning

An nginx-specific code that is never sent to the client: nginx closes the connection without a response. It appears only in the access log. Operators use return 444; to reject bots and requests with invalid hosts.

Common causes

  • return 444; in the nginx configuration, for example in the default server

How to fix it

  • If it's intentional, you don't need to do anything.
  • If it's unintentional, check the rule with nginx -T and search for return 444.

Configuration and commands (examples)

nginx
server {
    listen 80 default_server;
    return 444;
}
See also:
Defined in nginx

Meaning

The resource is blocked for legal reasons, such as a court order, censorship, or geoblocking. The code references Ray Bradbury’s novel “Fahrenheit 451”.

Common causes

  • Suspension by order, for example due to copyright or a government authority
  • The provider blocks certain regions due to legal requirements

How to fix it

  • The operator usually gives the reason in the response body.
  • Ask the operator; bypassing the block may be illegal.
See also:
Defined in RFC 7725

Meaning

The client closed the connection before nginx could send the response. This code appears only in the nginx log; it is not a real HTTP status code.

Common causes

  • A user stops the page from loading or closes the tab
  • The client timeout is shorter than the server’s response time
  • An upstream load balancer or proxy times out too soon

How to fix it

  • Reduce application response time, for example with slow database queries.
  • Align the client, proxy, and server timeouts.
See also:
Defined in nginx

Meaning

A general server error: the server encountered an unexpected problem and could not fulfill the request. The code doesn't reveal what went wrong; the cause is in the error log.

Common causes

  • Error in application code, such as a PHP fatal error or an uncaught exception
  • Invalid .htaccess or web server configuration
  • Incorrect file permissions or ownership on scripts
  • The database is unreachable or the credentials are incorrect
  • The PHP memory limit (memory_limit) or max_execution_time has been reached
  • A PHP extension is missing or the PHP version is incompatible with the plugin

How to fix it

  • Read the error log: It shows the file and line where the error occurred.
  • Undo changes from the last few minutes (plugin, update, .htaccess).
  • Test the configuration with nginx -t or apachectl configtest.
  • Enable debug mode (WP_DEBUG, APP_DEBUG) only locally or briefly, never permanently on a production system.

Configuration and commands (examples)

nginx
tail -n 50 /var/log/nginx/error.log
Apache
tail -n 50 /var/log/apache2/error.log
For search engine optimization: Googlebot visits less often when 5xx errors persist. If an error lasts for days, URLs may drop out of the index.
See also:
Defined in RFC 9110

Meaning

The server does not recognize the requested method or cannot implement it. Unlike 405, this is not specific to one resource; the method is not supported at all.

Common causes

  • An unusual or misspelled HTTP method
  • Server or proxy does not support this feature, for example due to outdated software

How to fix it

  • Check the method used.
  • Update the server software.
See also:
Defined in RFC 9110

Meaning

A server acting as a gateway or proxy (nginx, Apache, load balancer, CDN) received an invalid response or no response from the server behind it. The problem is between the servers, not with the visitor.

Common causes

  • The backend service (PHP-FPM, Node.js, Gunicorn, Docker container) is not running or has crashed
  • Wrong upstream: the port or socket in proxy_pass or fastcgi_pass is incorrect
  • The backend closes the connection prematurely, for example due to memory issues or a crash
  • A firewall or SELinux blocks the connection to the backend
  • A CDN cannot properly reach the origin server

How to fix it

  • Check the backend service status and restart it (systemctl status, docker ps).
  • Check whether anything is listening at the upstream address (ss -tlnp).
  • Read the web server’s error log: “connect() failed (111: Connection refused) while connecting to upstream” identifies the target.
  • Check the PHP-FPM socket path and permissions.
  • Is there enough RAM? The OOM killer often terminates the backend process first.

Configuration and commands (examples)

Shell
ss -tlnp | grep :3000
nginx
tail -n 50 /var/log/nginx/error.log
Shell
dmesg | grep -i "out of memory"
For search engine optimization: A brief 502 has little effect on search engines. If it persists, Googlebot treats the page like any other 5xx error and crawls it less often.
See also:
Defined in RFC 9110

Meaning

The server is temporarily unable to process the request, usually because of overload or maintenance. It can use “Retry-After” to indicate when to try again.

Common causes

  • Maintenance mode, for example in WordPress or Laravel, or scheduled maintenance
  • Overload: too many simultaneous requests or processes; for example, pm.max_children has been reached in PHP-FPM
  • A backend service behind a proxy or load balancer is unreachable
  • By default, nginx responds to limit_req and limit_conn limit violations with 503
  • Hosting resource limits (CPU, RAM, processes) reached

How to fix it

  • Turn off maintenance mode. Check for a .maintenance file (WordPress) or php artisan down (Laravel).
  • Check resource usage (top, free -m) and increase process limits such as pm.max_children.
  • For scheduled maintenance, deliberately return 503 with Retry-After.
  • Check the web server log for upstream errors.

Configuration and commands (examples)

nginx
error_page 503 /wartung.html;

location / {
    return 503;
}

location = /wartung.html {
    root /var/www/wartung;
    internal;
    add_header Retry-After 3600 always;
}
Apache
ErrorDocument 503 /wartung.html
Header always set Retry-After "3600"

RewriteEngine On
RewriteCond %{REQUEST_URI} !=/wartung.html
RewriteRule ^ - [R=503,L]
For search engine optimization: A brief 503 with Retry-After is the right approach for maintenance and search engines. If it lasts for days, the URLs may be removed from the index.
See also:
Defined in RFC 9110

Meaning

The gateway or proxy did not receive a timely response from the server behind it. Unlike a 502, the response is not invalid—it is too slow.

Common causes

  • A slow application: a heavy database query, report, import, or external API call
  • The backend is overloaded; all PHP-FPM workers are busy
  • The proxy timeout values are shorter than the request duration
  • A network problem between the proxy and backend

How to fix it

  • Find slow queries and scripts and speed them up (Slow Query Log, profiler).
  • Move long-running tasks to background jobs.
  • Increase the timeouts together: proxy_read_timeout, fastcgi_read_timeout, and max_execution_time in PHP.
  • Check backend capacity (workers, memory).

Configuration and commands (examples)

nginx
proxy_read_timeout 120s;
fastcgi_read_timeout 120s;
Apache
ProxyTimeout 120
See also:
Defined in RFC 9110

Meaning

The server does not support the HTTP version used in the request.

Common causes

  • A very old or faulty client or proxy uses an unusual HTTP version
  • The target system only supports a specific version

How to fix it

  • Update the client or force HTTP/1.1; with curl, use --http1.1.
See also:
Defined in RFC 9110

Meaning

The server's content negotiation configuration is faulty: the selected variant points back to negotiation. This is only seen with misconfigurations.

See also:
Defined in RFC 2295

Meaning

The server does not have enough storage space to complete the request.

Common causes

  • Disk, quota, or inodes are full
  • The upload can no longer be saved

How to fix it

  • Check disk space with df -h and df -i, and clear out old logs, Backups, and caches.
  • Increase the quota.

Configuration and commands (examples)

Shell
df -h && df -i
See also:
Defined in RFC 4918

Meaning

The server detected an infinite loop while processing the request.

Common causes

  • A circular WebDAV binding
  • A directory structure with a symlink loop

How to fix it

  • Check mounts and symlinks.
See also:
Defined in RFC 5842

Meaning

The request does not include the extension required by the server under RFC 2774. This code is historical and is almost never seen.

Defined in RFC 2774

Meaning

The client must sign in to the network before gaining access. Sent by a captive portal, such as on hotel, airport, or café Wi-Fi.

Common causes

  • A captive portal on the Wi-Fi requires login or consent

How to fix it

  • Open any page over http, such as http://neverssl.com, to make the portal appear.
  • Log in to the portal.
See also:
Defined in RFC 6585

Meaning

Cloudflare received a response from the origin server that it cannot process: empty, interrupted, or containing invalid headers. A catch-all Cloudflare error.

Common causes

  • The origin server crashes while processing the request, for example due to a PHP error
  • The response headers exceed 32 KB, often because of too many cookies
  • The response is empty or the connection was closed without a response
  • A firewall partially blocks Cloudflare IP addresses

How to fix it

  • Read the origin server’s error log.
  • Allow the Cloudflare IP ranges in the firewall and Fail2ban.
  • Reduce the size of headers and cookies.
See also:
Defined in Cloudflare

Meaning

Cloudflare could not connect to the origin server: it refused the connection. The site and Cloudflare are reachable, but your server behind them is not.

Common causes

  • The web server (nginx, Apache) is not running
  • A firewall or the hosting provider blocks Cloudflare IP addresses
  • Incorrect origin IP or port in the Cloudflare settings

How to fix it

  • Start the web server and check whether it is listening on ports 80 and 443.
  • Allow the Cloudflare IP ranges.
  • Check the DNS A record and origin port.

Configuration and commands (examples)

Shell
ss -tlnp | grep -E ':(80|443)\b'
See also:
Defined in Cloudflare

Meaning

Cloudflare tried to connect to the origin server, but the TCP handshake did not complete in time. The connection timed out before a request was sent.

Common causes

  • The origin server is overloaded or offline
  • A firewall drops packets from Cloudflare
  • Incorrect IP address or a routing problem

How to fix it

  • Check server availability and load.
  • Allow the Cloudflare IP ranges in the firewall.
  • Check the IP address in the DNS record.
See also:
Defined in Cloudflare

Meaning

Cloudflare cannot reach the origin server, for example because of a DNS error or a missing route.

Common causes

  • Incorrect IP address in the DNS record
  • Server or data center offline, routing issue

How to fix it

  • Check the DNS record.
  • Ask the hosting provider and check the network.
See also:
Defined in Cloudflare

Meaning

Cloudflare connected, but the origin server did not provide an HTTP response within 100 seconds.

Common causes

  • Long scripts, exports, or imports
  • An overloaded server

How to fix it

  • Move long-running tasks to background jobs.
  • Reduce response time.
  • Use streaming or status checks for long tasks instead of a single request.
See also:
Defined in Cloudflare

Meaning

The TLS handshake between Cloudflare and the origin server failed.

Common causes

  • The origin server does not offer HTTPS on port 443
  • No shared cipher suite or TLS version
  • SNI is missing or the certificate does not match

How to fix it

  • Check the origin server’s TLS configuration.
  • Choose the Cloudflare SSL/TLS mode that matches your origin server.
See also:
Defined in Cloudflare

Meaning

Cloudflare could not verify the origin server’s certificate. This occurs in “Full (strict)” mode.

Common causes

  • Certificate that is expired, self-signed or not issued for the domain
  • An intermediate certificate is missing

How to fix it

  • Install a valid certificate (Let's Encrypt or a Cloudflare Origin Certificate).
  • Serve the complete certificate chain.
See also:
Defined in Cloudflare

Example result

What the HTTP status code reference shows you

Enter a number or keyword to instantly find matching status codes, each with its meaning, common causes, a solution, and, where applicable, a ready-to-use nginx or Apache example. Three examples:

Example 1: Look up a number

Input:

502

Output: one entry with these details

Status code and name
502 Bad Gateway
Class
5xx Server error
Meaning
A server acting as a gateway or proxy (nginx, Apache, load balancer, CDN) received an invalid response or no response from the server behind it. The problem is between the servers, not with the visitor.
First common cause
The backend service (PHP-FPM, Node.js, Gunicorn, Docker container) is not running or has crashed
First solution step
Check the backend service status and restart it (systemctl status, docker ps).
Example to copy (nginx)
tail -n 50 /var/log/nginx/error.log

In words: A 502 Bad Gateway error means the server behind the proxy is not responding or has sent an invalid response. The entry lists 5 common causes and 5 troubleshooting steps, such as checking the backend service and reading the error log. The error occurs between the servers, not on the visitor’s end.

Example 2: Search for a class

Input:

3xx

Output: all 3xx class codes from the list

Search results for 3xx
Status codeName
300Multiple Choices
301Moved Permanently
302Found
303See Other
304Not Modified
307Temporary Redirect
308Permanent Redirect

In words: The list contains 7 codes of the 3xx class; the obsolete 305 and 306 are not included. Not all of them redirect, 304 for example points to the cache. The most important are 301 (moved permanently), 302 (temporarily redirected), and 304 (not modified; use the cache). Each entry explains when it occurs and how to use it correctly.

Example 3: Search for a keyword

Input:

timeout

Output: best matches first

  1. 408 Request Timeout
  2. 504 Gateway Timeout
  3. 524 A Timeout Occurred
  4. 102 Processing
  5. 499 Client Closed Request

In words: 5 entries contain the keyword. Matches in the name appear first: 408 Request Timeout, 504 Gateway Timeout, 524 A Timeout Occurred. These are followed by entries where “timeout” appears only in explanations, causes, or configuration examples.

How it works

How to look up a status code

Four steps from number to finished example, with no account or download.

Step 1

Enter a status code or keyword

Type a number like 502, a name like “bad gateway,” or a keyword like “timeout” or “redirect” in the search field. Results appear instantly as you type.

Step 2

Filter by class

Use the filters to narrow results by class: 3xx for redirects, 4xx for client errors, and 5xx for server errors. “Common searches” shows the codes you're likely to encounter.

Step 3

Expand entry

Click a code to see what it means and, where applicable, common causes, troubleshooting steps and SEO impact. “See also” takes you to related codes.

Step 4

Copy and customize example

Where helpful, an example for nginx, Apache, or the shell is included. Copy it, adjust the paths and values for your server, and reload the web server.

Common errors

404, 403, 500, 502, 503: the most common HTTP errors explained briefly

Brief answers for each error code. Select “All causes and solutions” to open the full entry in the reference above.

400

Bad Request

The server does not understand the request. Common causes include a malformed address, oversized or corrupted cookies and an invalid request header. Clear the site's cookies and check the address.

All causes and solutions

401

Unauthorized

This page requires authentication, and your credentials are missing or invalid. Use valid credentials, such as a password for .htaccess protection or a token for an API.

All causes and solutions

403

Forbidden

The server recognizes the address but denies you access. Common causes include incorrect file permissions, a missing index document, an IP block or a firewall rule.

All causes and solutions

404

Not Found

There’s nothing at this address: the URL may contain a typo, the page may have been deleted or moved, or the capitalization may be wrong. Use a 301 redirect for moved pages. Isolated 404 errors do not hurt your ranking.

All causes and solutions

429

Too Many Requests

You've sent too many requests in a short time. Wait for the duration specified in the Retry-After header, then try again with increasing intervals.

All causes and solutions

500

Internal Server Error

A general server error. The cause is in the web server's error log. Common causes include a code error, a broken .htaccess, incorrect permissions, or an unreachable database.

All causes and solutions

502

Bad Gateway

The proxy or load balancer is not receiving a valid response from the backend, usually because PHP-FPM, Node.js, or the application server is not running or has crashed. Check the service and its log.

All causes and solutions

503

Service Unavailable

The server is overloaded or undergoing maintenance and indicates that this is temporary. For maintenance, 503 with the Retry-After header is the appropriate code.

All causes and solutions

504

Gateway Timeout

The backend is responding too slowly, and the proxy gives up after its timeout. Check for slow queries or scripts and increase the timeout if needed; for nginx, use proxy_read_timeout.

All causes and solutions

Overview

The five classes of HTTP response codes

The first digit tells you the type of error. It lets you identify whether the problem is on the visitor's side or the server's without looking it up.

1xx

Information

The request has been received and is still being processed. This is an interim message, not a result yet.

Common:

4 codes in this reference

2xx

Success

The request was understood and processed successfully. 200 is the normal response.

Common: 200, 201, 204

10 codes in this reference

3xx

Redirect

The client must take another step, usually follow a new address or use the cache.

Common: 301, 302, 304, 307, 308

7 codes in this reference

4xx

Client error

The request is invalid or not allowed. From the server's perspective, the error is on the client side, such as a 404 for an unknown address.

Common: 400, 401, 403, 404, 405, 410, 413, 422, 429

31 codes in this reference

5xx

Server error

The request was valid, but the server did not fulfill it. The error is on the operator's side, such as a 500, 502, or 503.

Common: 500, 502, 503, 504

18 codes in this reference

Redirects

301 or 302? Redirect codes compared

Five codes redirect. They differ in two ways: whether the redirect is permanent and whether the client retains the HTTP method.

Comparison of redirect status codes 301, 302, 303, 307 and 308
Status codeDurationMethod remains unchanged
301 Moved PermanentlyMove a page or domain, redirect http to https, or redirect www to the main domain. The standard for SEO.permanentnot guaranteed
302 FoundTemporary redirect, for example for campaigns, login, or language selection.Temporarynot guaranteed
303 See OtherRedirect to a results page after a POST (Post/Redirect/Get). The browser retrieves it with GET.Temporarynot guaranteed
307 Temporary RedirectTemporary redirect for an API or form where the request method must be preserved.TemporaryYes
308 Permanent RedirectPermanent move of an API or form endpoint where the method must be preserved.permanentYes

Rule of thumb: use 301 for pages moved permanently and 302 for temporary moves. To preserve POST for an API or form, use 308 instead of 301 and 307 instead of 302. “Not guaranteed” means browsers often turn a POST into a GET.

Practice

How to find a page’s status code

In your browser, open Developer Tools (F12) and check the Network tab to see the code for each request. On a server or in a shell, these four commands can help:

Shows only the response headers; the first line contains the status code.

curl -I https://example.com/seite

Outputs only the status code, useful for scripts and monitoring.

curl -s -o /dev/null -w "%{http_code}\n" https://example.com/seite

Follows redirects and shows each hop with its status code and destination.

curl -sIL https://example.com/alt | grep -iE '^(HTTP|location)'

Counts status codes in an nginx or Apache access log (combined format) and sorts them by frequency.

awk '{print $9}' /var/log/nginx/access.log | sort | uniq -c | sort -rn

Discover more

More tools

Website Down Checker

Check whether a website is online, slow, or offline: HTTP status, response time, and the cause of errors such as DNS issues, timeouts, TLS errors, or 5xx responses.

Built by Eric Mager

SSL Checker

Check an SSL/TLS certificate’s status, issuer, validity period, and expiration date at a glance.

Built by Sebastian Rademacher

Redirect Checker

Check a URL’s redirect chain hop by hop: status codes (301/302/307/308), HTTP headers, server IP, and response time for each redirect.

Built by Luca Stanek

Port Checker

Check whether specific ports are open on an IP or hostname—select a protocol or game instead of scanning all ports at once.

Built by Sebastian Rademacher

CHMOD Calculator

Build Unix/Linux file permissions using checkboxes to get an octal value and symbolic notation, or decode them in reverse — including setuid/setgid/the sticky bit and a ready-to-copy chmod command.

Built by Justin Schuessler

.htaccess Generator & htpasswd Generator

Create Apache .htaccess and .htpasswd files online: 301 redirects, HTTPS, password protection with bcrypt, WordPress rules, error pages, caching, GZIP, and hotlink protection. Runs entirely in your browser.

Built by Dimitri Heissler

FAQ

Frequently asked questions

Quick answers about common HTTP codes, their causes and this reference.

An HTTP status code is a three-digit number a server returns for every request. It tells you whether the request succeeded and, if not, why. The first digit identifies the class: 1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error. The HTTP error codes you are most likely to encounter are 400, 401, 403, 404 and 429 for client errors, and 500, 502, 503 and 504 for server errors. The “Commonly searched” filter in the reference shows these alongside other frequently encountered codes.

200 OK means the request succeeded and the server returned the page or data. This is the normal response for any page visitors and search engines should see. Make sure error pages are not returned with 200, or they can become “soft 404s”. Related codes: 201 Created indicates a newly created resource; 204 No Content indicates a successful response without a body; and 304 Not Modified means the file has not changed, so the browser uses its cached copy.

The server cannot understand the request and rejects it before processing it. Common causes include a malformed URL with invalid characters, oversized or corrupted cookies, an oversized header, and an incorrectly formatted request body sent to an API. As a visitor, clear the site’s cookies. As an operator, check the request, headers and logs. If the format is correct but a value is invalid, such as a missing required field, many APIs instead return 422 Unprocessable Content (formerly “Unprocessable Entity”).

The server is reachable but does not recognize the address. First check for typos and the file name's capitalization, which matters on Linux. Then check the path on the web server and, for WordPress or a single-page app, the rewrite rules (try_files in nginx). Redirect moved pages with a 301. Individual 404 errors do not hurt rankings, but important pages with backlinks leading nowhere can.

401 Unauthorized means “not authenticated”: valid credentials will grant access. 403 Forbidden means “access denied, whether authenticated or not”: the server still refuses access. Common causes of 403 include incorrect file permissions or ownership, a missing index document, IP blocks and WAF rules. The CHMOD calculator converts permissions such as 755 for directories and 644 for files. Go to CHMOD Calculator

The code does not reveal the cause. Check the web server error log (for nginx, /var/log/nginx/error.log; for Apache, /var/log/apache2/error.log) or the PHP log. Common causes include a code error, a faulty .htaccess file, incorrect file permissions, an unreachable database, or an exhausted PHP memory limit. Revert the most recent change (plugin, update, rule) and test the configuration with nginx -t or apachectl configtest.

502 Bad Gateway: The proxy receives an invalid response or no response from the backend, usually because the service (PHP-FPM, Node.js) is not running. 503 Service Unavailable: The server is overloaded or under maintenance and reports this itself. 504 Gateway Timeout: The backend responds too slowly, usually because of an expensive query or overload. For all three, start by reading the error log and checking the backend service. For planned maintenance, use 503 with a “Retry-After” header, not a maintenance page returned with 200.

301 signals a permanent move: search engines adopt the new address and transfer rankings. 302 signals a temporary redirect: the old address stays in the index. Use 301 for domain and page moves, and 302 for temporary uses such as campaigns. If a form or API needs to preserve the method (POST), use 308 instead of 301 and 307 instead of 302.

These are not standard HTTP codes. Codes 520 to 526 come from Cloudflare and indicate that Cloudflare, not your visitor, has a problem communicating with your origin server: 520 unknown error, 521 connection refused, 522 connection could not be established, 523 origin server unreachable, 524 no response within 100 seconds, 525 TLS handshake failed, 526 invalid certificate. Usually, allowing Cloudflare IP ranges through your firewall and checking your web server and certificate helps. Codes 444 and 499 appear only in nginx logs: for 444, nginx deliberately closes the connection without a response; for 499, the client closed the connection before the response arrived.

In your browser, press F12 to open Developer Tools and check the Status column in the Network tab. In a shell, curl -I https://example.com shows the headers and status code, while curl -s -o /dev/null -w "%{http_code}" https://example.com outputs only the number. Use curl -sIL to see every redirect along the way. This reference does not request any addresses: it runs entirely in your browser. Only the search term and class filter appear in the URL so you can share a search. Use the Redirect Checker to check a redirect chain. Go to Redirect Checker

Any more questions?

Contact Support
Running something of your own?

Status code 200 instead of 502: hosting that delivers your application reliably

A ZAP-Hosting VPS reliably puts your application or project online.

4.4/5 Trustpilot32,000+ Active serversSince 2010
View hosting

No setup. No risk. Online in seconds.

Flexible TermCancel anytimeOnline in 60 seconds

Looking for more tools? View all developer tools