HTTP Status Codes
Search every registered HTTP status code from 100 to 511 with its RFC 9110 section, what it means and when to send it, plus nginx 499 and Cloudflare 52x codes.
The interactive tool loads here when JavaScript runs.
About this toolWhat is the HTTP Status Codes reference?
This HTTP status code reference lists every code in the IANA HTTP Status Code Registry, from 100 Continue to 511 Network Authentication Required, with the RFC section that defines it, a one-line meaning and practical advice on when a server should send it. Type a code such as 429, a class such as 5xx, or a few words such as "rate limit" or "keep method", and the list narrows as you type. Click any row to read the details and copy them.
Real logs contain more than the registry, so the list also includes the codes you meet in practice but will not find in an RFC: nginx's 444 and 499, the 52x family Cloudflare returns when it cannot reach your origin, and Laravel's 419. They are labelled unofficial and can be hidden with one switch. A small helper on the side answers the most common question about redirects: given whether a move is permanent and whether a POST must stay a POST, it tells you whether you want 301, 302, 307 or 308.
- All 63 IANA-registered codes with RFC section references
- Common nginx, Cloudflare, Apache and Laravel codes, clearly flagged
- Search by code, class or words, with class filters
- Default cacheability from RFC 9110 §15.1
- Redirect picker for 301, 302, 307 and 308
- Copy-ready details; works offline in the browser
How to use the HTTP Status Codes reference
- Type a status code, a class such as 4xx, or a few words describing the situation into the search box.
- Use the class chips to show only some classes, and switch off unofficial codes if you only want IANA-registered ones.
- Click a row to open its details: when to use it, common mistakes, the defining RFC section and whether it is cacheable by default.
- Copy the details into a ticket or code review with the copy button.
- For redirects, answer the two questions in the side panel to get the right 3xx code.
Worked examples
Rate limiting an API
Input
Search "rate"
Output
429 Too Many Requests, RFC 6585 §4
Send 429 with a Retry-After header in seconds or as an HTTP date. 503 is for the whole service being unavailable, not one client being throttled.
Moving a form endpoint permanently
Input
Permanent: yes, keep method: yes
Output
308 Permanent Redirect
A 301 would let the browser re-send the form as a GET to the new URL and lose the body. 308 keeps the method and body.
A code that is not registered
Input
299
Output
Treated like 200 OK
Clients fall back to the x00 code of the class for anything unknown, so a custom 2xx tells them nothing more than 200.
A mystery code in the nginx log
Input
499
Output
Client Closed Request (nginx, unofficial)
The client gave up before the upstream answered. Lots of 499s usually mean a slow backend or a client timeout shorter than the server's.
Background and insight
Status codes are defined by HTTP Semantics, RFC 9110, published in June 2022. It replaced RFC 7231 and its siblings and became the single home for the core codes in its section 15, along with a few renames: 413 is now "Content Too Large" and 422, which moved over from WebDAV, is "Unprocessable Content". Codes added later live in their own documents and are collected in the IANA registry: 429 Too Many Requests and 431 Request Header Fields Too Large come from RFC 6585 (2012), 451 Unavailable For Legal Reasons from RFC 7725, 425 Too Early from RFC 8470 and 103 Early Hints from RFC 8297.
The first digit carries most of the meaning. RFC 9110 requires a client that receives a code it does not recognise to treat it as the x00 code of the same class, so an unknown 299 behaves like 200 and an unknown 599 like 500. That is why inventing new codes is discouraged: intermediaries will only ever see the class. Section 15.1 also lists the codes that are cacheable by default when no explicit freshness is given (200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414 and 501), which explains why a mistaken 301 or a temporary 404 can linger in caches.
Two pairs cause most of the confusion in API design. 401 means the request has no valid credentials and must come with a WWW-Authenticate header; 403 means the server knows who you are and still says no. For redirects, the original 301 and 302 allowed clients to turn a POST into a GET, which browsers did. HTTP/1.1 (RFC 2616) added 307 and RFC 7538 added 308 as method-preserving versions, so an API that moves an upload endpoint should use 307 or 308.
Common use cases
Designing an API
Choose between 400 and 422, 401 and 403, or 409 and 412 when writing error handling and OpenAPI specs.
Reading logs and dashboards
Decode unfamiliar codes in access logs, CDN dashboards and monitoring alerts, including vendor codes.
SEO migrations
Check which redirect and removal codes search engines treat as permanent before moving or deleting pages.
Code review and interviews
Quote the RFC section when a pull request returns 200 with an error body or 500 for bad input.
Tips and limitations
- Return 4xx when the client can fix the request and 5xx when it cannot. Monitoring and retries depend on that split.
- Do not return 200 with an error message in the body; caches, crawlers and client libraries will treat it as success.
- A 204 response must not have a body, and a 304 never has one; some proxies hang if you send bytes anyway.
- Browsers cache 301s aggressively. Test new redirects as 302, then switch to 301 or 308 once they are right.
- Send Retry-After with 429 and 503 so well-behaved clients and crawlers know when to come back.
- The vendor codes in this list never come from your application code; they describe what a proxy or CDN saw.
Frequently asked questions
What is the difference between 401 Unauthorized and 403 Forbidden?
401 means the request lacks valid authentication, so logging in or sending a fresh token could succeed; the response must include a WWW-Authenticate header. 403 means the server understood who is asking and refuses anyway, so new credentials for the same user will not help.
Should an API return 400 or 422 for a validation error?
Both are allowed by RFC 9110. Use 400 for malformed requests such as broken JSON or missing parameters, and 422 Unprocessable Content when the syntax is fine but the values break a rule. Pick one convention and document it.
When should I use 301 versus 308?
Both are permanent. With 301, clients may change a POST to GET when they follow the redirect; with 308 they must repeat the same method and body. For pages and links 301 is fine; for API endpoints and form targets use 308.
What does 499 mean in nginx logs?
499 Client Closed Request is an nginx-only code written to the access log when the client closed the connection before nginx sent a response. It never reaches the client. A spike usually means a slow upstream or a short client timeout.
Is 418 I'm a teapot a real HTTP status code?
It began as an April Fools' joke in RFC 2324 about controlling coffee pots. RFC 9110 now reserves 418 as unused because so much software implements the joke that it cannot be given a real meaning. Do not use it for actual errors.
Which status codes are cacheable by default?
RFC 9110 section 15.1 lists 200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414 and 501. Caches may store these with a heuristic lifetime when the response has no Cache-Control or Expires header. Other codes are cached only when headers explicitly allow it.
What should a client do with a status code it does not know?
Treat it as the x00 code of its class. An unrecognised 2xx is handled like 200, an unrecognised 4xx like 400 and an unrecognised 5xx like 500. This rule comes from RFC 9110 section 15.
Is there an in-depth guide to the HTTP Status Codes reference?
Yes. “HTTP Status Codes Explained: What Each Class Means and When to Send It” covers the background, how it works, common pitfalls and worked examples. Read the full guide.
People also search for
- difference between 401 and 403 status code
- should i return 400 or 422 for validation errors
- what does nginx 499 client closed request mean
- 301 vs 308 redirect which to use
- which http status codes are cacheable by default
- is 418 im a teapot a real status code
- cloudflare 522 vs 524 error meaning
- http 413 content too large nginx fix
Related Tools You May Like
Free, in-browser tools that pair well with this one.