HTTP Status Codes

Look up any HTTP status code: what it means, when to use it, and what clients do with it.

A code, a class or some words

Every code in the catalogue: 75

100Continue1xx Informational
The server has read the request headers and is telling the client to go ahead and send the body. It is an interim answer to an Expect: 100-continue header, and the final response still follows.
When to use it
A large upload whose body the server may reject before it arrives: the client asks first and only pays for the transfer once the server agrees.
Common mistakes
Sending 100 without having read the headers, and clients that wait forever for it because a proxy or a server dropped the Expect header on the way.
Not cacheable by defaultRFC 9110Every code
101Switching Protocols1xx Informational
The server accepts the client’s Upgrade header and is changing protocols on this connection — HTTP/1.1 to WebSocket, most often. After the blank line the connection is no longer HTTP.
When to use it
The handshake that opens a WebSocket, or a move to a newer protocol version, over a connection that already exists.
Common mistakes
Agreeing to a protocol the application cannot actually speak, and expecting HTTP to resume afterwards: everything after a 101 belongs to the new protocol.
Not cacheable by defaultRFC 9110Every code
102Processing1xx Informational
The server has taken the whole request and is working on it, but no response is ready. WebDAV introduced it to stop a client from giving up on a long COPY or MOVE.
When to use it
Rarely outside WebDAV: a single request that will take minutes, where the client would otherwise time out.
Common mistakes
Reading it as a final answer, or as a promise that the work will succeed. It only says the request arrived and is being handled.
Not cacheable by defaultRFC 2518Every code
103Early Hints1xx Informational
A preliminary response carrying headers — usually Link headers that preload a stylesheet or a font — sent while the server is still working out the real response.
When to use it
A slow page whose assets are known early: the browser starts fetching them while the server finishes rendering the HTML.
Common mistakes
Putting a body in it, and assuming every intermediary forwards it: older proxies drop interim responses, so nothing important belongs here.
Not cacheable by defaultRFC 8297Every code
200OK2xx Success
The request worked and the response body carries the result.
When to use it
The ordinary answer to a successful GET, and to any POST or PUT that returns the resource it changed.
Common mistakes
Returning 200 with an error message in the body, or with an empty body where 204 says the same thing honestly.
Cacheable by defaultRFC 9110Every code
201Created2xx Success
The request made a new resource, and the Location header names where it now lives.
When to use it
A POST that inserts a row or a file, and a PUT that created something that did not exist yet.
Common mistakes
Using it for an update, which changes a resource rather than making one, and leaving out Location so the client cannot find what it just made.
Not cacheable by defaultRFC 9110Every code
202Accepted2xx Success
The request has been accepted for processing but is not finished, and there is no promise that it ever will be. The body usually carries a ticket the client can poll.
When to use it
Queues and background work: the request is recorded, the answer comes later.
Common mistakes
Returning it when the work is already done, and accepting a job with no way for the client to learn how it went.
Not cacheable by defaultRFC 9110Every code
203Non-Authoritative Information2xx Success
The payload came from an intermediary that changed or added to what the origin sent, so it is not the origin’s exact bytes.
When to use it
A transforming proxy that rewrites content and wants to admit it.
Common mistakes
Using it for an ordinary pass-through, where 200 is correct, and reading it as a warning that the data is wrong: it is only second-hand.
Cacheable by defaultRFC 9110Every code
204No Content2xx Success
The request succeeded and there is deliberately nothing in the body; the client keeps the page or document it already has.
When to use it
A DELETE that worked, a PUT that saved without returning the saved copy, or a beacon whose response nobody reads.
Common mistakes
Sending a body with it, which the specification forbids, and using it where the client needs the new state back.
Cacheable by defaultRFC 9110Every code
205Reset Content2xx Success
The request succeeded and the client should clear the form or view it just submitted.
When to use it
A form post that should leave the fields empty rather than showing the old values again.
Common mistakes
Confusing it with 204: a 205 asks the client to reset its view, so browsers do not treat the two the same way.
Not cacheable by defaultRFC 9110Every code
206Partial Content2xx Success
The body holds only part of the resource, as asked for with a Range header, and Content-Range says which part it is.
When to use it
Resumable downloads, video seeking, and parallel fetches of a large file.
Common mistakes
Sending it without Content-Range, or ignoring the range and answering with the whole file as a 200.
Cacheable by defaultRFC 9110Every code
207Multi-Status2xx Success
A batch of separate operations each got its own status, all reported in one XML body.
When to use it
WebDAV PROPFIND and batch writes where some items succeed and others fail, and the client needs both.
Common mistakes
Expecting a plain HTTP client to read the body: without the DAV XML the response says almost nothing.
Not cacheable by defaultRFC 4918Every code
208Already Reported2xx Success
Inside a DAV multistatus, this binding was already listed earlier in the same response, so it is not repeated.
When to use it
Deep PROPFINDs over a tree with several paths to the same resource.
Common mistakes
Sending it as a response on its own: it only means anything inside the body of a 207.
Not cacheable by defaultRFC 5842Every code
226IM Used2xx Success
The server applied instance manipulations to the representation, answering the deltas the client said it already had.
When to use it
Delta encoding: a client holding an old copy asks for the changes since it, and gets only those.
Common mistakes
Treating it as an ordinary 200, and expecting caches to store it as one: a client that skipped the deltas cannot use the result.
Not cacheable by defaultRFC 3229Every code
300Multiple Choices3xx Redirection
The target has several representations and the server is leaving the choice to the client, often listing them in the body.
When to use it
Content negotiation where the alternatives are genuinely different resources, not one canonical URL.
Common mistakes
Reaching for it where a 301 or a 302 would do: browsers rarely show the list, so the client usually ends up nowhere.
Cacheable by defaultRFC 9110Every code
301Moved Permanently3xx Redirection
The resource lives at a new URL now. The move is permanent, so caches and search engines should update their copy and stop asking for the old address.
When to use it
A renamed page, a site that changed hostnames, the www to apex redirect: the everyday permanent redirect.
Common mistakes
Pointing it at something that may move again, and forgetting that clients may repeat a POST as a GET after following it.
Cacheable by defaultRFC 9110Every code
302Found3xx Redirection
The resource is temporarily at another URL; the old one stays valid and will serve again.
When to use it
Sending a signed-out visitor to a sign-in page, or any redirect whose target will change back.
Common mistakes
Leaving it in place for years, and expecting caches to follow it: 302 is not cacheable by default, so clients keep hitting the original.
Not cacheable by defaultRFC 9110Every code
303See Other3xx Redirection
The answer to the request is at another URL and must be fetched with GET, whatever method got you here.
When to use it
Post/Redirect/Get: a form post that finishes by sending the browser to the result page, so a refresh does not submit it again.
Common mistakes
Using a 302 for that job and letting some clients resubmit the POST, and putting the result in the redirect body where nobody reads it.
Not cacheable by defaultRFC 9110Every code
304Not Modified3xx Redirection
The client’s cached copy is still good, so there is no body: the response only refreshes the cache’s idea of how fresh it is.
When to use it
Answering a conditional GET whose If-None-Match or If-Modified-Since matches what the client already holds.
Common mistakes
Sending it without the validators or cache headers the client needs, and sending a body with it, which is not allowed.
Not cacheable by defaultRFC 9110Every code
305Use Proxy3xx Redirection
Deprecated: the client is told to reach the resource through the proxy named in Location. Servers stopped sending it long ago, because it leaks the proxy and people found the behaviour unsafe.
When to use it
Nothing new. It is in the registry, and documented here, only so nobody mistakes it for a redirect.
Common mistakes
Sending it at all, or reading the Location header on it as the address of the resource.
Not cacheable by defaultRFC 9110Every code
306(Unused)3xx Redirection
Reserved and unused. An old draft used it to say a proxy had switched, and that draft was dropped; the registry keeps the number so it can never be handed out.
When to use it
Never. It is listed only to say it means nothing.
Common mistakes
Assuming it is a redirect because it sits between 305 and 307, and sending it to a client.
Not cacheable by defaultRFC 9110Every code
307Temporary Redirect3xx Redirection
The resource is temporarily elsewhere, and the client must repeat the request at the new URL with the same method and the same body.
When to use it
Redirecting a POST or a PUT without turning it into a GET, which is what 302 often ends up doing.
Common mistakes
Expecting browsers to cache it, and using it where the move really is permanent: that is 308.
Not cacheable by defaultRFC 9110Every code
308Permanent Redirect3xx Redirection
The resource has moved for good, and the client must repeat the request at the new URL with the same method and the same body.
When to use it
An endpoint that has been renamed where the method matters, and a whole hostname moving without losing POSTs.
Common mistakes
Using it for a move you may undo, and expecting every client to follow it: some old ones treat it as a plain 301.
Cacheable by defaultRFC 9110Every code
400Bad Request4xx Client error
The server cannot make sense of the request: malformed syntax, an unreadable header, or a body that is not what it claims to be.
When to use it
Any input the endpoint cannot parse at all, including a broken JSON body or a bad query parameter.
Common mistakes
Using it as a catch-all for anything the user got wrong — well-formed but nonsensical values are 422 — and returning it for a fault on the server’s side.
Not cacheable by defaultRFC 9110Every code
401Unauthorized4xx Client error
The request lacks valid credentials for this resource. Despite the name it means unauthenticated: sign in, then send the request again. The WWW-Authenticate header says how.
When to use it
A missing, expired or wrong token or session cookie, and the challenge a browser shows as a login prompt.
Common mistakes
Confusing it with 403 — being signed in and still not allowed is 403 — and forgetting WWW-Authenticate, which leaves a browser with nothing to do.
Not cacheable by defaultRFC 9110Every code
402Payment Required4xx Client error
Reserved for future use by the registry, and shipped by APIs as the answer for an account that owes money or has used up its plan.
When to use it
Metered and paid endpoints: the request is fine, the subscription is not.
Common mistakes
Expecting a standard meaning — browsers and caches have none — so the body has to say what payment or plan is needed.
Not cacheable by defaultRFC 9110Every code
403Forbidden4xx Client error
The server understood the request and refuses to do it. The credentials, if there are any, are not the problem, and sending them again will not help.
When to use it
A signed-in user reaching something outside their role, a blocked address, or a resource the app will not serve to this caller.
Common mistakes
Using it for a missing login (that is 401) and for a resource that does not exist (that is 404; a 403 here tells the caller the resource is real).
Not cacheable by defaultRFC 9110Every code
404Not Found4xx Client error
Nothing lives at that address, and saying so is safe: the server does not have to admit whether anything ever did.
When to use it
An unknown path, a deleted row, an id that never existed.
Common mistakes
Hiding a permission failure behind it, or the reverse, and returning it for errors that are the server’s own fault.
Cacheable by defaultRFC 9110Every code
405Method Not Allowed4xx Client error
The address is real, but it does not answer to that method. The Allow header lists the methods it does accept.
When to use it
A POST to a read-only endpoint, or a DELETE on a resource that cannot be deleted.
Common mistakes
Returning 404 because the handler was never written, and leaving out Allow.
Cacheable by defaultRFC 9110Every code
406Not Acceptable4xx Client error
The server cannot produce a representation that the client’s Accept headers will take.
When to use it
An API that only speaks JSON receiving a request that insists on XML.
Common mistakes
Returning it because a header was absent, where the default representation would have been perfectly acceptable.
Not cacheable by defaultRFC 9110Every code
407Proxy Authentication Required4xx Client error
A proxy in front of the origin wants credentials before it passes the request on. The challenge comes from the proxy, not from the server behind it.
When to use it
Corporate and shared proxies that authenticate the people using them.
Common mistakes
Confusing it with 401, and forgetting Proxy-Authenticate: without it the client has no idea what the proxy wants.
Not cacheable by defaultRFC 9110Every code
408Request Timeout4xx Client error
The server gave up waiting for the rest of the request on this connection.
When to use it
Slow clients that stop mid-request, and idle connections the server is reclaiming.
Common mistakes
Reporting it to the user as if their own requests timed out — that is usually 504 — and expecting the client to retry by itself.
Not cacheable by defaultRFC 9110Every code
409Conflict4xx Client error
The request clashes with the current state of the resource: a duplicate key, a version that has moved on, or two edits in flight at once.
When to use it
Unique constraint violations, and optimistic locking where the client’s version no longer matches what is stored.
Common mistakes
Sending it for field validation, which is 422, and leaving the client with no way to see the state it collided with.
Not cacheable by defaultRFC 9110Every code
410Gone4xx Client error
The resource existed here and has been deliberately removed. Unlike 404, the server knows it is not coming back.
When to use it
Retired endpoints and deleted content you do not intend to restore, so clients and crawlers can drop them for good.
Common mistakes
Using it for something that moved, where a redirect serves the client better, and for temporary outages.
Cacheable by defaultRFC 9110Every code
411Length Required4xx Client error
The server refuses the request because it did not carry a Content-Length header.
When to use it
Endpoints that need the size up front, usually to enforce a limit before reading anything.
Common mistakes
Sending it when the client used chunked transfer encoding properly, which is a valid way to send a body of unknown length.
Not cacheable by defaultRFC 9110Every code
412Precondition Failed4xx Client error
One of the conditions on the request — If-Match, If-Unmodified-Since — did not hold, so nothing was changed.
When to use it
Conditional writes that must not overwrite somebody else’s newer change.
Common mistakes
Confusing it with 409, which is about a clash with the resource itself, and with 304, which answers a conditional read.
Not cacheable by defaultRFC 9110Every code
413Content Too Large4xx Client error
The body is bigger than the server is willing to take.
When to use it
Upload caps and body size rules, often enforced by the web server before your code ever runs.
Common mistakes
Assuming the client reads the explanation: many servers close the connection mid-upload, so the message never arrives.
Not cacheable by defaultRFC 9110Every code
414URI Too Long4xx Client error
The address is longer than the server will accept, and the request line may have been cut short before the headers were read.
When to use it
A query string that grew past a size rule — usually a sign that the filter belongs in the body of a POST instead.
Common mistakes
Retrying the same address, and expecting an answer at all: the server often drops the connection without one.
Cacheable by defaultRFC 9110Every code
415Unsupported Media Type4xx Client error
The Content-Type of the request is not one this endpoint handles.
When to use it
An endpoint that takes JSON being sent XML, or an upload in a format the app cannot read.
Common mistakes
Confusing it with 406, which is about what the server sends back rather than what the client sent.
Not cacheable by defaultRFC 9110Every code
416Range Not Satisfiable4xx Client error
The range the client asked for lies outside the resource — a seek past the end of a file, most often. Content-Range: bytes */<length> says how big the resource actually is.
When to use it
Range requests on a file whose size changed since the client last looked.
Common mistakes
Using it for any bad range, including a malformed one, which is a 400.
Not cacheable by defaultRFC 9110Every code
417Expectation Failed4xx Client error
The server cannot meet the expectation in the Expect header, which in practice means it will not do the 100-continue dance.
When to use it
Rare: an intermediary that cannot handle an expected handshake says so instead of hanging.
Common mistakes
Sending it as a general validation failure, which is what 400 and 422 are for.
Not cacheable by defaultRFC 9110Every code
418I’m a Teapot4xx Client errorUnofficial · RFC 2324
A joke that stuck. RFC 2324, the 1998 April Fools specification for coffee pots, gave the number its phrase; the registry itself lists 418 as unused, and servers and frameworks keep it alive as an Easter egg.
When to use it
Fun only: a prank endpoint, or a test of how a client copes with a code it has never seen.
Common mistakes
Putting it in a real API contract, and expecting a standard meaning — the registry has none to offer.
Not cacheable by defaultDefined by RFC 2324Every code
421Misdirected Request4xx Client error
The request arrived at a server that cannot answer for that name: a reused TLS connection for a host it does not cover, or an authority it does not serve.
When to use it
Connection coalescing and multiplexing, where one connection carries several hostnames.
Common mistakes
Retrying on the same connection instead of opening a fresh one to the right server.
Not cacheable by defaultRFC 9110Every code
422Unprocessable Content4xx Client error
The request was understood and its syntax is fine, but it cannot be acted on: the fields are there and their values are wrong.
When to use it
Validation failures in an API — the classic answer to a body that parses but makes no sense.
Common mistakes
Confusing it with 400, which is about syntax, and with 409, which is about state, and leaving out which fields were at fault.
Not cacheable by defaultRFC 9110Every code
423Locked4xx Client error
The resource is locked, so this change cannot be made until the lock is released.
When to use it
WebDAV editing that locks a document while somebody works on it; a few APIs borrow it for a record under edit.
Common mistakes
Using it for an ordinary permission refusal, which is 403, and locking without a way to release.
Not cacheable by defaultRFC 4918Every code
424Failed Dependency4xx Client error
The request failed because another request it depended on had already failed.
When to use it
Batch or transactional work where one step failing invalidates the steps that counted on it.
Common mistakes
Using it where a plain 500 or 409 would say more, and reporting it without naming the step that broke.
Not cacheable by defaultRFC 4918Every code
425Too Early4xx Client error
The server will not risk processing a request that might be a replay; the client should send it again, later.
When to use it
TLS 0-RTT data, where an early request could be a copy of one already seen.
Common mistakes
Reaching for it as a rate limit, which is 429, and treating it as final rather than as a request to retry.
Not cacheable by defaultRFC 8470Every code
426Upgrade Required4xx Client error
The server refuses the request at the current protocol and asks the client to switch, naming what it wants in an Upgrade header.
When to use it
An endpoint that only accepts TLS, or an old API version being shut off.
Common mistakes
Expecting an ordinary client to retry by itself: the client has to understand the upgrade, so most simply report the failure.
Not cacheable by defaultRFC 9110Every code
428Precondition Required4xx Client error
The server wants the request to be conditional — an If-Match — before it will change anything.
When to use it
Guarding writes against lost updates, so a client cannot overwrite a change it never saw.
Common mistakes
Returning it without saying which precondition is required, which leaves the client guessing.
Not cacheable by defaultRFC 6585Every code
429Too Many Requests4xx Client error
The client has sent too many requests in a given time. Retry-After says how long to wait, and the limit is usually described in RateLimit headers or in the body.
When to use it
Rate limits and quotas on public endpoints, including the ones you impose to keep one client from taking the lot.
Common mistakes
Returning it without Retry-After, and counting timeouts or errors of your own as if the client had asked too often.
Not cacheable by defaultRFC 6585Every code
431Request Header Fields Too Large4xx Client error
The request headers, as a whole or one of them, are bigger than the server will take.
When to use it
Cookie headers that grew out of hand, or an oversized token on the Authorization header.
Common mistakes
Confusing it with 413, which is about the body, and assuming the client can read the answer: some servers drop the connection first.
Not cacheable by defaultRFC 6585Every code
451Unavailable For Legal Reasons4xx Client error
The server is refusing to serve this by law or by a legal demand, and the body may name the law or the order behind it.
When to use it
Geo-blocked content and takedowns that a court or a regulator demanded, where a 404 would be a lie.
Common mistakes
Using it for an ordinary moderation decision, and blocking without saying which law is being complied with.
Not cacheable by defaultRFC 7725Every code
444No Response4xx Client errorUnofficial · nginx
nginx’s own code for closing a connection without answering at all. Nothing is written back, so no client ever sees a status line.
When to use it
Dropping traffic you do not want to answer: malformed requests, a hostname you do not serve, a probe you would rather ignore.
Common mistakes
Trying to return it from an application, and debugging a client that sees an empty reply as though a real response were lost.
Not cacheable by defaultDefined by nginxEvery code
449Retry With4xx Client errorUnofficial · Microsoft IIS
A Microsoft extension asking the client to send the request again with more information, described in the response.
When to use it
Rarely, and only inside IIS: it is how that stack demands an extra parameter mid-request.
Common mistakes
Relying on it in a public API: it is not in the registry, and anything but IIS will treat the code as unknown.
Not cacheable by defaultDefined by Microsoft IISEvery code
499Client Closed Request4xx Client errorUnofficial · nginx
nginx writes this into its own logs when the client disconnected before the answer was ready. The server never sends it; you find it after the fact.
When to use it
Reading a log: it usually means a timeout, a retry, or an impatient user, not a fault on the server’s side.
Common mistakes
Trying to return it from an application, and blaming the origin for requests that nobody was waiting for.
Not cacheable by defaultDefined by nginxEvery code
500Internal Server Error5xx Server error
Something went wrong on the server and it has no better way to say what.
When to use it
The last resort for an unhandled fault, where the logs carry the detail and the client gets nothing but the bad news.
Common mistakes
Using it for input the client can fix, and for expected failures like a missing record that has its own code.
Not cacheable by defaultRFC 9110Every code
501Not Implemented5xx Server error
The server does not support the functionality the request asks for — an unknown method, or a feature it has not built.
When to use it
A method the server genuinely does not implement at all, which is rare in an app that has a router.
Common mistakes
Using it for an endpoint that exists but rejected this input, still less for a temporary outage, which is 503.
Cacheable by defaultRFC 9110Every code
502Bad Gateway5xx Server error
A gateway or proxy got an unusable answer from the server behind it.
When to use it
A reverse proxy whose upstream crashed, closed the connection early, or sent something that was not a response.
Common mistakes
Reporting it for faults in your own application, and retrying forever when the upstream is simply down.
Not cacheable by defaultRFC 9110Every code
503Service Unavailable5xx Server error
The server cannot handle the request right now, usually because it is overloaded or down for maintenance. Retry-After says when to come back.
When to use it
Planned maintenance, load shedding, and upstreams that are briefly out of service.
Common mistakes
Leaving it up for hours with no Retry-After, and returning it for a permanent failure that is really a 500.
Not cacheable by defaultRFC 9110Every code
504Gateway Timeout5xx Server error
A gateway waited for the server behind it and gave up waiting.
When to use it
A slow upstream behind a proxy that has a timeout of its own.
Common mistakes
Blaming the client, when 408 is the code for a client that was too slow, and setting the proxy’s timeout shorter than the work honestly needs.
Not cacheable by defaultRFC 9110Every code
505HTTP Version Not Supported5xx Server error
The request arrived with a major HTTP version the server is not willing to speak.
When to use it
Telling a client that its protocol version is not supported at all.
Common mistakes
Confusing it with a refused upgrade, which is 426: this one is about the version the request itself used.
Not cacheable by defaultRFC 9110Every code
506Variant Also Negotiates5xx Server error
A content negotiation fault: the variant chosen to answer is itself a negotiator, so the choice would go round in circles.
When to use it
Almost never; it exists for transparent negotiation setups that misconfigure a variant.
Common mistakes
Returning it from ordinary load balancing or A/B testing, where no negotiation is involved.
Not cacheable by defaultRFC 2295Every code
507Insufficient Storage5xx Server error
The server cannot store what the request needs to store.
When to use it
WebDAV writes, and the APIs that borrow it to report a storage quota that has run out.
Common mistakes
Using it for a client’s oversized upload, which is 413, and for a disk that filled up mid-write without the client being able to do anything.
Not cacheable by defaultRFC 4918Every code
508Loop Detected5xx Server error
The server stopped while working on the request because it found an endless loop, such as a collection that contains itself.
When to use it
Deep WebDAV operations over a tree with a cycle in it.
Common mistakes
Using it for redirect loops, which are the client’s problem, and for recursion your own code should have bounded.
Not cacheable by defaultRFC 5842Every code
509Bandwidth Limit Exceeded5xx Server errorUnofficial · cPanel
A hosting-panel convention, from cPanel and WHM, for an account that has used up its monthly traffic allowance.
When to use it
Nothing standard. Panels and a few appliances use it to say a quota has run out.
Common mistakes
Expecting clients, caches or the registry to know it, and shipping it in an API where a 429 or a 402 says more.
Not cacheable by defaultDefined by cPanelEvery code
510Not Extended5xx Server error
The request needs more extensions than the server is willing to apply, and the response says which ones it would have wanted.
When to use it
Servers built on the HTTP extension framework of RFC 2774, which very few deployments use.
Common mistakes
Using it for a missing header or a failed check: it is about a framework almost nobody deploys.
Not cacheable by defaultRFC 2774Every code
511Network Authentication Required5xx Server error
The client must authenticate to get network access. It is the answer a hotel or airport captive portal gives, not one your own site would normally send.
When to use it
Captive portals and gating proxies, which also send a login page the client can show.
Common mistakes
Returning it from an application to mean a login is required, which is what 401 is for.
Not cacheable by defaultRFC 6585Every code
520Web Server Returned an Unknown Error5xx Server errorUnofficial · Cloudflare
Cloudflare got an empty or unreadable answer from the origin — something it could not turn into a response.
When to use it
Only Cloudflare sends it. At the origin end it usually means a crash, a killed process, or a response so malformed it could not be parsed.
Common mistakes
Returning it from an application, and guessing at the cause without reading the origin’s own logs.
Not cacheable by defaultDefined by CloudflareEvery code
521Web Server Is Down5xx Server errorUnofficial · Cloudflare
Cloudflare is up and the origin refused the connection.
When to use it
Diagnosing Cloudflare: the origin is not listening, or a firewall is turning Cloudflare’s addresses away.
Common mistakes
Looking in the application’s logs: the request never reached it, so the answer is at the network layer.
Not cacheable by defaultDefined by CloudflareEvery code
522Connection Timed Out5xx Server errorUnofficial · Cloudflare
Cloudflare could not open a TCP connection to the origin in time.
When to use it
Diagnosing Cloudflare: a firewall, a route or a network silently dropping Cloudflare’s packets.
Common mistakes
Confusing it with 524, where the connection did open and the answer was merely slow.
Not cacheable by defaultDefined by CloudflareEvery code
523Origin Is Unreachable5xx Server errorUnofficial · Cloudflare
Cloudflare cannot find a route to the origin at all, usually because the address it was given does not resolve.
When to use it
Diagnosing Cloudflare: a wrong or missing record for the origin server.
Common mistakes
Retrying without checking DNS and the origin address in the dashboard, which is where the fault is.
Not cacheable by defaultDefined by CloudflareEvery code
524A Timeout Occurred5xx Server errorUnofficial · Cloudflare
Cloudflare connected to the origin, but the origin did not finish its answer inside Cloudflare’s window of about a hundred seconds.
When to use it
Diagnosing Cloudflare: slow queries, a long job running inside the request, or an origin that is simply overworked.
Common mistakes
Confusing it with 522, and raising no timeout anywhere while leaving the work as slow as it was.
Not cacheable by defaultDefined by CloudflareEvery code
525SSL Handshake Failed5xx Server errorUnofficial · Cloudflare
Cloudflare and the origin could not complete a TLS handshake.
When to use it
Diagnosing Cloudflare: mismatched cipher suites, or an origin that cannot present a certificate for the name asked for.
Common mistakes
Staring at the certificate Cloudflare serves to browsers: the handshake that failed is the one behind Cloudflare.
Not cacheable by defaultDefined by CloudflareEvery code
526Invalid SSL Certificate5xx Server errorUnofficial · Cloudflare
Cloudflare reached the origin but would not trust the certificate it presented.
When to use it
Diagnosing Cloudflare: an origin certificate that is expired, self-signed, or issued for the wrong name.
Common mistakes
Confusing it with 525, which fails before any certificate is judged, and switching the mode to flexible TLS to make the error go away.
Not cacheable by defaultDefined by CloudflareEvery code
527Railgun Error5xx Server errorUnofficial · Cloudflare
A retired Cloudflare feature. Railgun was a compression link between Cloudflare and the origin, and this code meant the connection across it broke.
When to use it
Only on old Cloudflare setups that had Railgun switched on.
Common mistakes
Chasing it today: the feature is gone, so treat anything you find as an ordinary 5xx on the origin path and look there.
Not cacheable by defaultDefined by CloudflareEvery code

Every code, by class

1xx Informational

100 101 102 103

2xx Success

200 201 202 203 204 205 206 207 208 226

3xx Redirection

300 301 302 303 304 305 306 307 308

4xx Client error

400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 421 422 423 424 425 426 428 429 431 451 444 449 499

5xx Server error

500 501 502 503 504 505 506 507 508 509 510 511 520 521 522 523 524 525 526 527

Codes marked unofficial come from one server’s own convention — nginx, Cloudflare, cPanel, Microsoft — and are not in the IANA registry.

HTTP Status Codes

Every code, by class

More in the yard