HTTP Status Codes - Full List with Meanings, Causes and Fixes

Every HTTP status code in the IANA registry in plain English: what it means, when you see it, the usual fix and caching. Search by number, name or word.

Maintained by Hirantha Sandaruwan Lakshan. Updated 15 October 2026.

About this tool

An HTTP status code is the three-digit answer a server gives to every request: 200 means it worked, 404 means nothing is there, 500 means the server failed. This page lists every code in the IANA registry with a plain-English meaning, where you are likely to meet it, what to do about it, and whether caches may store it. Search by number, name or keyword, filter by class, and link straight to a code such as #404. Widely used codes from Cloudflare and nginx are in a separate, clearly labelled group.

How it works

How the codes are grouped. The first digit is the class. 1xx codes are interim answers, sent before the final one. 2xx means the request worked. 3xx means the client has to take another step, usually following a redirect. 4xx means the request is wrong or not allowed, so changing the request may fix it. 5xx means the request looked fine but the server failed to handle it. Clients are expected to treat an unknown code as the x00 code of its class.

Where the list comes from. Names and numbers are those in the IANA HTTP Status Code Registry, last updated 2025-09-15 when this page was checked on 2026-10-15. RFC 9110 defines the core codes in its section 15. Other documents add WebDAV codes (RFC 4918 and 5842), 428, 429, 431 and 511 (RFC 6585), 451 (RFC 7725), 425 (RFC 8470) and 103 (RFC 8297). IANA lists 306 and 418 as (Unused): reserved so nobody reuses them. Code 104 is only a temporary registration for a draft that expires on 2026-11-13 unless extended. Unassigned numbers are not listed.

The caching column. RFC 9110 section 15.1 names the codes that a cache may reuse with heuristic freshness by default: 200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414 and 501. RFC 7725 makes 451 cacheable by default too. Any other final status is stored only when the response carries explicit freshness information such as max-age. RFC 6585 says 428, 429, 431 and 511 must not be stored by a cache. 1xx answers are interim and are never stored, and a 304 does not carry a body: it tells the cache its stored copy is still good.

Unofficial codes. Some products invent codes of their own. Cloudflare's 520 to 526 and 530 appear when Cloudflare cannot get a good answer from your origin server, and nginx uses 444 (close the connection without a reply) and 495 to 497 (client certificate and plain-HTTP-to-HTTPS errors), plus 499 in its logs when a client gives up. They are not part of the HTTP standard, so their meaning holds only where that product is in the path. Each is shown with a link to the vendor's own documentation.

How to use it. Type a number, part of a name or a word such as redirect, timeout or rate limit. Use the filters to look at one class, the common codes, or the unofficial group. Open a row to see when you will meet the code, what to do and where it is defined. Copy gives you the code and name; Copy link gives a URL that opens this page at that code.

Worked examples

Which redirect to use

Moved a page for good: send 301, or 308 if POST requests must stay POST. Sent a visitor to a login page and back: 302, or 307 to keep the method. Sent the browser to a result page after a form POST: 303, so a refresh does not repeat the action. 301 and 302 let clients turn a POST into a GET when they follow the redirect; 307 and 308 do not (RFC 9110 sections 15.4.2, 15.4.3, 15.4.8 and 15.4.9).

401 or 403

A request with no token, or an expired one, gets 401 and a WWW-Authenticate header that says how to log in. A request with a valid token that is not allowed to see the page gets 403. If you would rather not reveal that a page exists, a server may answer 404 instead of 403.

Cloudflare 522 versus 524

522 means Cloudflare could not reach your server in time: no reply to its connection attempt within 19 seconds, or no acknowledgement of its request within 90 seconds, according to Cloudflare. 524 means it connected and sent the request, but your server returned no HTTP response within the default 125 seconds. The first points to firewalls, routing or a dead server; the second to a slow job.

Being rate limited: 429

A client that sends too many requests in a given time gets 429, often with a Retry-After header saying how long to wait. Wait that long, then retry with a growing delay between attempts. Responses with 429 must not be stored by a cache (RFC 6585).

All HTTP status codes in the IANA registry, plus widely used unofficial codes from nginx and Cloudflare

Code	Name	What it means	When you will see it	What to do	Cached by default?	Defined in
100	Continue	The server has seen the start of the request and is happy for the client to send the rest.	A client that asked with Expect: 100-continue before sending a large body. Libraries usually handle it, so most developers never see it.	Nothing to fix. If an upload stalls while waiting for it, check that the server or proxy supports Expect: 100-continue.	Not applicable (interim response)	RFC 9110, section 15.2.1
101	Switching Protocols	The server agrees to switch to the protocol the client asked for in its Upgrade header.	The reply to a WebSocket handshake, and to other protocol upgrades on the same connection.	Nothing to fix. If a WebSocket connection fails to open, check that every proxy in the path forwards the Upgrade and Connection headers.	Not applicable (interim response)	RFC 9110, section 15.2.2
102	Processing	An interim WebDAV reply: the server has the whole request and is still working on it.	Old WebDAV servers sent it during slow operations so the client would not give up. It was dropped from the later WebDAV standard, so you will rarely see it.	Nothing to fix. Read it as "please wait".	Not applicable (interim response)	RFC 2518
103	Early Hints	A preview of headers sent before the final answer, so the browser can start fetching files the page will need.	Servers and CDNs that already know the page's key stylesheets or scripts while the page itself is still being built.	Nothing to fix. To use it, send Link headers with rel=preload in a 103 response ahead of the final 200.	Not applicable (interim response)	RFC 8297
104	Upload Resumption Supported	The server tells the client it can resume an interrupted upload instead of starting again.	Only on servers that implement the resumable upload draft. It is a draft, not a finished standard.	Nothing to fix. As a draft, the details may still change.	Not applicable (interim response)	draft-ietf-httpbis-resumable-upload
200	OK	The request worked and the response carries the result.	Almost every normal page load, API read or form result.	Nothing to fix. If a page shows an error message but the status is 200, the application is hiding failures from monitoring tools, so return a real error code.	Yes, by default	RFC 9110, section 15.3.1
201	Created	The request worked and a new resource now exists.	After a POST or PUT that makes something new, such as a user or a record. The Location header normally gives its address.	Nothing to fix.	Only with explicit cache headers	RFC 9110, section 15.3.2
202	Accepted	The server took the request but has not finished the work, and the work may still fail.	Queued jobs, report exports and other background work.	Nothing to fix. Check the status address in the response, or wait for the callback, to learn how it ended.	Only with explicit cache headers	RFC 9110, section 15.3.3
203	Non-Authoritative Information	The request worked, but a proxy changed the content on the way, so it may differ from what the origin sent.	Rare. Proxies that rewrite or compress content and say so.	Nothing to fix. If the content looks altered, try the request without the proxy.	Yes, by default	RFC 9110, section 15.3.4
204	No Content	The request worked and there is nothing to send back.	Saving a document, deleting a record, or an API call that has no result to show.	Nothing to fix. If a client expects JSON and breaks on an empty reply, return 200 with a body instead.	Yes, by default	RFC 9110, section 15.3.5
205	Reset Content	The request worked and the client should clear the form or view that sent it.	Rare. Data entry screens that reset after each submission.	Nothing to fix. It is rarely used, so check that your client handles it if you send it.	Only with explicit cache headers	RFC 9110, section 15.3.6
206	Partial Content	The server is sending only the part of the file that was asked for.	Video and audio seeking, resumed downloads, and PDF viewers that fetch a file in byte ranges.	Nothing to fix. If seeking or resuming fails, check that the server supports Range requests.	Yes, by default	RFC 9110, section 15.3.7
207	Multi-Status	A WebDAV reply that holds separate results for several operations at once.	WebDAV clients, and some APIs that batch many actions into one request.	Read each result inside the body. A 207 does not mean every part succeeded.	Only with explicit cache headers	RFC 4918
208	Already Reported	A WebDAV shorthand that avoids listing the same items twice in one reply.	Rare. WebDAV collections that can be reached by more than one binding.	Nothing to fix.	Only with explicit cache headers	RFC 5842
226	IM Used	The server answered a GET with the current version of the resource after applying the transformations the client asked for, typically a delta against an older copy the client holds.	Very rare. Delta encoding for HTTP.	Nothing to fix.	Only with explicit cache headers	RFC 3229
300	Multiple Choices	More than one version of the resource exists and the client has to pick one.	Rare. A server that offers several formats or languages and lists links to them.	Choose one of the listed addresses, or give the resource a single canonical address.	Yes, by default	RFC 9110, section 15.4.1
301	Moved Permanently	The resource has a new permanent address. Use the new one from now on.	Site moves, HTTP to HTTPS redirects and renamed pages.	Update links and bookmarks to the new address. If you hit a redirect loop, check that two rules are not sending the address back and forth.	Yes, by default	RFC 9110, section 15.4.2
302	Found	The resource is temporarily at another address. Keep using the original address in future.	Login redirects and short-term moves.	If the move is permanent, use 301 or 308 instead. If you hit a loop, check redirect rules and cookies.	Only with explicit cache headers	RFC 9110, section 15.4.3
303	See Other	The result is at a different address, and the client should fetch that address with GET.	After a form POST, to send the browser to a confirmation page so that a refresh does not repeat the action.	Nothing to fix. This is the usual "post, then redirect" pattern.	Only with explicit cache headers	RFC 9110, section 15.4.4
304	Not Modified	Your stored copy is still current, so no body is sent.	Browsers and caches checking a stored page, image or file with If-None-Match or If-Modified-Since.	Nothing to fix. If you keep seeing stale content, check the Cache-Control and ETag settings.	Not stored: it refreshes a cached copy	RFC 9110, section 15.4.5
305	Use Proxy	Deprecated. It was meant to tell the client to repeat the request through a given proxy.	Practically never.	Do not send it. Configure proxies another way.	Only with explicit cache headers	RFC 9110, section 15.4.6
306	(Unused)	Reserved. An older version of HTTP defined it, and it is no longer used. It stays reserved so it is not handed out for something else by accident.	Never in normal use.	Nothing to fix. If a server sends it, the server is misconfigured.	Only with explicit cache headers	RFC 9110, section 15.4.7
307	Temporary Redirect	Like 302, but the client must repeat the request with the same method and body.	Temporary moves of an API or form target where a POST has to stay a POST.	If the move is permanent, use 308 instead.	Only with explicit cache headers	RFC 9110, section 15.4.8
308	Permanent Redirect	Like 301, but the client must repeat the request with the same method and body.	Permanent moves of an API endpoint or form target.	Update clients, links and bookmarks to the new address.	Yes, by default	RFC 9110, section 15.4.9
400	Bad Request	The server cannot or will not handle the request because it looks wrong, for example broken syntax or a malformed body.	Invalid JSON, a missing field, an oversized cookie or a malformed URL.	Check the URL, headers and body you sent. In a browser, clearing the site's cookies often helps. APIs usually explain the problem in the response body.	Only with explicit cache headers	RFC 9110, section 15.5.1
401	Unauthorized	The request has no valid login credentials. Despite the name, this is about who you are (authentication), not what you may do.	A missing, expired or wrong token, API key or password.	Sign in again or send valid credentials. The response must carry a WWW-Authenticate header that says how to authenticate.	Only with explicit cache headers	RFC 9110, section 15.5.2
402	Payment Required	Reserved for future use. The standard gives it no meaning yet.	A few services use it informally for billing problems, in their own way.	Read the service's own documentation to see what it means there.	Only with explicit cache headers	RFC 9110, section 15.5.3
403	Forbidden	The server understood the request and refuses to allow it, even if you are signed in.	You lack permission, an IP address or country is blocked, or file permissions on the server deny access.	Check account rights, firewall and IP rules, and the permissions on the file or directory on the server. A different account may have access.	Only with explicit cache headers	RFC 9110, section 15.5.4
404	Not Found	The server has no current page at this address, or will not say that one exists.	A mistyped or old link, a deleted page, or a route that does not exist.	Check the address for typos. If you run the site, fix or redirect broken links and make sure the file or route exists. If it is gone for good, 410 says so more precisely.	Yes, by default	RFC 9110, section 15.5.5
405	Method Not Allowed	The address exists, but not for the method you used (for example a POST to a read-only page).	Calling an API with the wrong verb, or a server or proxy blocking PUT or DELETE.	Use a method the resource allows. The Allow header in the response lists them. Check proxy and server rules that block methods.	Yes, by default	RFC 9110, section 15.5.6
406	Not Acceptable	The server has no version of the resource that matches the formats or languages the client said it accepts.	A strict Accept header that the API cannot satisfy.	Correct or loosen the Accept, Accept-Language or Accept-Encoding headers.	Only with explicit cache headers	RFC 9110, section 15.5.7
407	Proxy Authentication Required	Like 401, but the login needed is for a proxy between you and the site.	Company or school proxies.	Enter the proxy's credentials, or set them in your client's proxy settings.	Only with explicit cache headers	RFC 9110, section 15.5.8
408	Request Timeout	The server gave up waiting for the client to finish sending the request.	Slow or stalled connections, or an idle connection that the server closed.	Retry. Check your connection and the size of the upload. If you run the server, review its timeout settings.	Only with explicit cache headers	RFC 9110, section 15.5.9
409	Conflict	The request clashes with the current state of the resource.	Editing a record that someone else changed, creating something that already exists, or a version conflict.	Reload the latest state, resolve the difference and send the request again.	Only with explicit cache headers	RFC 9110, section 15.5.10
410	Gone	The resource used to be here and was removed on purpose, with no forwarding address.	Expired promotions, deleted accounts and retired pages.	Remove links to it. If you run the site and the page is gone for good, 410 tells clients not to expect it back.	Yes, by default	RFC 9110, section 15.5.11
411	Length Required	The server insists on a Content-Length header.	Uploading from a client that streams a body without declaring its size.	Send a Content-Length header with the exact size of the body.	Only with explicit cache headers	RFC 9110, section 15.5.12
412	Precondition Failed	A condition in the request headers, such as If-Match, was false on the server.	Updating a resource that has changed since you fetched it, when you sent its ETag.	Fetch the latest version and its ETag, then try again.	Only with explicit cache headers	RFC 9110, section 15.5.13
413	Content Too Large	The request body is bigger than the server is willing to accept.	File uploads above a limit. In nginx, client_max_body_size defaults to 1m and larger bodies get a 413.	Upload a smaller file, or raise the limit on the server and on any proxy in front of it.	Only with explicit cache headers	RFC 9110, section 15.5.14
414	URI Too Long	The address (URL) is longer than the server will process.	Very long query strings, or a redirect loop that keeps adding to the URL.	Shorten the URL, move the data into a POST body, and check for a redirect loop.	Yes, by default	RFC 9110, section 15.5.15
415	Unsupported Media Type	The server does not accept the format of the request body.	Sending JSON without Content-Type: application/json, or a file type the endpoint refuses.	Set the right Content-Type and send a format the endpoint supports.	Only with explicit cache headers	RFC 9110, section 15.5.16
416	Range Not Satisfiable	The byte range asked for lies outside the file.	Resuming a download of a file that has since changed or got shorter.	Restart the download without the Range header. The Content-Range header in the response shows the real size.	Only with explicit cache headers	RFC 9110, section 15.5.17
417	Expectation Failed	The server cannot meet what the Expect header asked for.	Rare. A client sends Expect: 100-continue to a server or proxy that does not support it.	Remove the Expect header, or turn it off in your HTTP client's settings.	Only with explicit cache headers	RFC 9110, section 15.5.18
418	(Unused), known as I'm a teapot	Reserved. It comes from RFC 2324, an April Fools' joke about a coffee pot protocol, where it reads "I'm a teapot". It is not meant for real errors.	Developer jokes and Easter eggs.	Nothing to fix. It was never meant for real errors. If a real service returns it, read that service's own documentation.	Only with explicit cache headers	RFC 9110, section 15.5.19
421	Misdirected Request	The request reached a server that cannot answer for that host name.	Connection reuse (for example with HTTP/2) where one connection serves several sites with different certificates or settings.	Retry on a new connection. If you run the server, check TLS (SNI) and virtual host settings.	Only with explicit cache headers	RFC 9110, section 15.5.20
422	Unprocessable Content	The request is well formed, but the server cannot act on what it says.	APIs that validate fields: an invalid email address, a date in the past, or another rule that fails.	Read the error details in the response body, correct the data and send it again.	Only with explicit cache headers	RFC 9110, section 15.5.21
423	Locked	The source or destination resource of a WebDAV method is locked.	WebDAV and document systems when someone else has the file locked.	Wait for the lock to be released, or unlock it using the correct lock token.	Only with explicit cache headers	RFC 4918
424	Failed Dependency	A WebDAV action failed because another action it depended on failed first.	WebDAV batch operations such as PROPPATCH, where one failure stops the rest.	Find and fix the first failure listed in the response.	Only with explicit cache headers	RFC 4918
425	Too Early	The server will not process the request yet, because it arrived as TLS early data that could be replayed.	Servers and proxies that accept TLS 1.3 early data and want to protect requests that must not be replayed.	The client should retry once the TLS handshake finishes. HTTP libraries normally do this for you.	Only with explicit cache headers	RFC 8470
426	Upgrade Required	The server will not use the current protocol but may do so after the client upgrades to another one.	A server that insists on a newer protocol version. The Upgrade header names it.	Switch to the protocol or version named in the Upgrade header.	Only with explicit cache headers	RFC 9110, section 15.5.22
428	Precondition Required	The server will only accept this request if it carries a condition such as If-Match, so that two people cannot overwrite each other's changes.	APIs that insist on If-Match before an update.	Add an If-Match header with the current ETag of the resource.	No, caches must not store it	RFC 6585
429	Too Many Requests	You have sent too many requests in a given time. This is rate limiting.	APIs, login forms and websites that limit how fast one client may call them.	Slow down and retry after the delay in the Retry-After header, if there is one. Add back-off and caching to your client.	No, caches must not store it	RFC 6585
431	Request Header Fields Too Large	The request headers are too big, either one header or all of them together.	Cookies that have grown too large, or very long URLs and tokens in headers.	Clear the site's cookies, trim large headers, or raise the header size limits on the server.	No, caches must not store it	RFC 6585
451	Unavailable For Legal Reasons	Access is blocked because of a legal demand, such as a court order or a law.	Content removed or blocked by a host, ISP or search engine for legal reasons. The number matches the title of the novel Fahrenheit 451, and RFC 7725 thanks its author, Ray Bradbury.	There is little you can do from the client. The site owner has to resolve the legal issue.	Yes, by default	RFC 7725
500	Internal Server Error	The server hit an unexpected problem and could not complete the request.	A bug, bad configuration or crashed script on the server.	Visitors: try again later. Site owners: read the server and application error logs to find the exact error.	Only with explicit cache headers	RFC 9110, section 15.6.1
501	Not Implemented	The server does not support the feature or method needed to handle the request.	An unknown HTTP method, or functionality the server was never built to provide.	Use a method the server supports. If you run it, add the feature, or answer 405 or 404 where that fits better.	Yes, by default	RFC 9110, section 15.6.2
502	Bad Gateway	A gateway or proxy got an answer it could not use from the server behind it.	Reverse proxies and CDNs when the app server has crashed, is restarting or sent garbage.	Retry. Site owners: check that the upstream app is running, listening on the expected port and reachable, and read the proxy and app logs.	Only with explicit cache headers	RFC 9110, section 15.6.3
503	Service Unavailable	The server cannot take the request right now, usually from overload or planned maintenance.	Traffic spikes, deployments and maintenance windows.	Wait and retry, and honour the Retry-After header if it is there. Site owners: check load, capacity and whether maintenance mode is on.	Only with explicit cache headers	RFC 9110, section 15.6.4
504	Gateway Timeout	A gateway or proxy waited too long for the server behind it to answer.	Slow database queries or slow calls to other services behind a proxy or CDN.	Retry. Site owners: find what is slow upstream, and raise the proxy timeout only as a stopgap while you fix that.	Only with explicit cache headers	RFC 9110, section 15.6.5
505	HTTP Version Not Supported	The server does not support the major HTTP version used in the request.	Rare. Very old or very new clients talking to a server that lacks that version.	Use a supported HTTP version, or update the server.	Only with explicit cache headers	RFC 9110, section 15.6.6
506	Variant Also Negotiates	A server configuration error in content negotiation: the variant chosen is itself set up to negotiate, so it cannot be the final answer.	Very rare. Misconfigured transparent content negotiation (RFC 2295).	Site owners: fix the negotiation setup so that a variant does not negotiate again.	Only with explicit cache headers	RFC 2295
507	Insufficient Storage	The server has no room to store what the request needs. This is a WebDAV code.	WebDAV uploads to a full disk or an exhausted quota.	Free disk space or raise the quota on the server.	Only with explicit cache headers	RFC 4918
508	Loop Detected	The server stopped an operation because it found an endless loop. This is a WebDAV code.	WebDAV requests with Depth: infinity on a tree that links back to itself.	Remove the circular link or binding in the resource tree.	Only with explicit cache headers	RFC 5842
510	Not Extended (OBSOLETED)	Obsolete. The server wanted the request to carry further extensions before it would fulfil it.	Practically never. The HTTP extension framework behind it was moved to Historic status.	Treat it as a server-side problem and read that server's own documentation.	Only with explicit cache headers	RFC 2774 (obsoleted)
511	Network Authentication Required	The network itself wants you to sign in before it lets you online.	Captive portals on hotel, airport and cafe Wi-Fi.	Open any plain web page to get the portal's sign-in screen, log in, then retry.	No, caches must not store it	RFC 6585
444	No Response (nginx)	nginx closes the connection without sending any reply at all.	A site owner puts return 444 in the nginx configuration to drop unwanted requests. The client sees a dropped connection, not a page.	Visitors: nothing to fix, the site chose to drop the request. Site owners: look at the return 444 rules if real visitors are being dropped.	Not defined (non-standard code)	Unofficial (nginx): nginx docs, ngx_http_rewrite_module
495	SSL Certificate Error (nginx)	An error occurred while nginx was verifying the client's TLS certificate.	Sites that require client certificates, when the certificate sent is invalid or not trusted.	Send a valid client certificate that the server trusts. Site owners: check the CA used for ssl_client_certificate.	Not defined (non-standard code)	Unofficial (nginx): nginx docs, ngx_http_ssl_module
496	SSL Certificate Required (nginx)	The client did not present the certificate that nginx requires.	Sites that require client certificates, when the client sent none.	Install a client certificate and make your client send it.	Not defined (non-standard code)	Unofficial (nginx): nginx docs, ngx_http_ssl_module
497	HTTP Request Sent to HTTPS Port (nginx)	A plain HTTP request was sent to a port that expects HTTPS.	Typing http:// with a port number that serves HTTPS, or a proxy pointed at the wrong port.	Use https:// in the address, or send the plain request to the plain HTTP port.	Not defined (non-standard code)	Unofficial (nginx): nginx docs, ngx_http_ssl_module
499	Client Closed Request (nginx)	The client closed the connection before nginx had sent a reply. nginx uses the number in its logs.	nginx access logs, when a visitor cancels, times out or navigates away. The client is already gone, so it never receives this code.	Usually nothing. If 499s spike, the app behind nginx may be too slow, so clients give up first.	Not defined (non-standard code)	Unofficial (nginx): nginx source, ngx_http_request.h
520	Web Server Returns an Unknown Error (Cloudflare)	Cloudflare reached your server but got an empty, unknown or unexpected reply.	An origin that crashes, a firewall blocking Cloudflare, response headers over 128 KB (often cookies), or a wrong HTTP/2 setup at the origin.	Check the origin's error logs for crashes. Make sure Cloudflare's IP addresses are allowed. Check header sizes and HTTP/2 settings at the origin.	Not defined (non-standard code)	Unofficial (Cloudflare): Cloudflare docs, error 520
521	Web Server Is Down (Cloudflare)	The origin web server refused the connection from Cloudflare.	The origin application is offline, or a firewall blocks Cloudflare's IP addresses.	Make sure the origin is running and listening on the right port (80 for Flexible SSL/TLS, 443 for Full), and that Cloudflare's IP ranges are allowed.	Not defined (non-standard code)	Unofficial (Cloudflare): Cloudflare docs, error 521
522	Connection Timed Out (Cloudflare)	Cloudflare timed out while trying to connect to, or get an acknowledgement from, the origin.	An overloaded or offline origin, blocked or rate-limited Cloudflare IP addresses, or a DNS record that points at the wrong origin IP.	Check that the origin is online and not overloaded, that Cloudflare's IP ranges are allowed, and that the DNS record has the right origin IP address.	Not defined (non-standard code)	Unofficial (Cloudflare): Cloudflare docs, error 522
523	Origin Is Unreachable (Cloudflare)	Cloudflare cannot find a network route to your origin server.	A wrong origin IP address in DNS, or a routing problem between your server and Cloudflare.	Check the origin IP in your Cloudflare DNS record, and ask your hosting provider to look at routing between the origin and Cloudflare.	Not defined (non-standard code)	Unofficial (Cloudflare): Cloudflare docs, error 523
524	A Timeout Occurred (Cloudflare)	Cloudflare connected to the origin, but the origin did not reply within the default 125 seconds.	A long-running request, such as a big report or query, or an origin short of resources.	Speed up the slow request, or move long jobs to a background task and have the page poll for the result.	Not defined (non-standard code)	Unofficial (Cloudflare): Cloudflare docs, error 524
525	SSL Handshake Failed (Cloudflare)	The TLS handshake between Cloudflare and the origin server failed.	Full or Full (strict) SSL/TLS mode, and an origin with no valid certificate, a closed port 443, no SNI support or no matching cipher suite.	Install a valid certificate at the origin, open port 443, and check SNI and cipher suite support. A free Cloudflare Origin CA certificate is one option.	Not defined (non-standard code)	Unofficial (Cloudflare): Cloudflare docs, error 525
526	Invalid SSL Certificate (Cloudflare)	Cloudflare could not validate the TLS certificate on your origin server.	Full (strict) SSL/TLS mode with an expired, revoked, self-signed or wrong-name certificate at the origin.	Install a valid, unexpired certificate for your host name with a complete chain, or use a Cloudflare Origin CA certificate. Switching to Full mode is a stopgap.	Not defined (non-standard code)	Unofficial (Cloudflare): Cloudflare docs, error 526
530	Origin DNS Error (Cloudflare)	Cloudflare could not resolve the origin host name. The page body contains a 1xxx error code with more detail.	A DNS problem with the origin host name that your Cloudflare zone points to.	Look up the 1xxx error code shown in the page body and follow the steps for that code.	Not defined (non-standard code)	Unofficial (Cloudflare): Cloudflare docs, error 530

Frequently asked questions

What is the difference between 401 and 403?

401 means the request has no valid credentials, so who you are is unknown or wrong, and the server must say how to authenticate. 403 means the server knows what you asked for and refuses it even with those credentials. Log in again for a 401; ask for permission for a 403.

What is the difference between 301 and 302?

301 says the resource has moved permanently, so use the new address from now on. 302 says it is temporarily somewhere else, so keep using the original address. Both let clients change a POST into a GET when following the redirect; 308 and 307 are the versions that keep the method.

What does 418 I'm a teapot mean?

It comes from RFC 2324, an April Fools' joke about a coffee pot protocol. RFC 9110 says the code has been used as a joke often enough to be unusable for anything else, so IANA lists 418 as (Unused) and reserves it. Real servers should not send it for real errors.

What is the difference between 502, 503 and 504?

502 means a gateway or proxy got an invalid answer from the server behind it. 503 means the server cannot take the request right now, usually because of overload or maintenance, and may say when to retry. 504 means the gateway waited too long for the server behind it to answer.

Which status codes are cached by default?

Per RFC 9110: 200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414 and 501, and 451 per RFC 7725. All other final codes need explicit freshness information, and 428, 429, 431 and 511 must not be stored at all. The table shows the rule for every code.

Should a deleted page return 404 or 410?

404 says the server has no page at that address, without saying whether that is permanent. 410 says the page used to exist and was removed on purpose with no forwarding address. Use 410 when you are sure it is gone for good, and 404 when you are not.

Should an API use 400 or 422 for a bad request?

400 fits a request the server cannot parse: broken JSON or a missing required field. 422 fits a request that is well formed but whose content cannot be acted on, such as an email address that fails validation. Many APIs use only 400; what matters is that the body explains the problem.

Is Cloudflare error 520 a real HTTP status code?

It is not in the IANA registry. Cloudflare uses 520 to 526 and 530 for its own error pages when it cannot get a good response from your origin server. 520 means an empty, unknown or unexpected response. Cloudflare's documentation lists the usual causes and fixes, linked in the table.

Sources & references

Updated Oct 15, 2026