HTTP Status Codes List

About HTTP Status Codes

Every HTTP response starts with a three-digit code, and the first digit says most of it: 2xx worked, 3xx means go somewhere else, 4xx means the request was wrong, and 5xx means the server failed. The rest is in the details, and the details are where APIs and proxies go wrong.

Each code comes with the two answers the name leaves out: whether a cache may store it without being told to, and whether a client should retry it. A 404 is cacheable by default, which surprises people who deploy the missing page a minute later. A 500 is worth retrying with backoff, but a 400 will fail the same way however many times it is sent.

Look up a number, a whole class such as 4xx, or words such as rate limit or redirect. Codes that are not registered but show up in real logs are included and marked: nginx's 444 and 499, and Cloudflare's 520 to 526.

Where it helps

• Says for each code whether a cache may store it by default and whether a client should retry it, which the name alone does not.
• Shows what happens to the method on each redirect, which is the difference between 301 and 308 and between 302 and 307.
• Includes the unregistered codes that appear in real logs, such as nginx's 499 and Cloudflare's 52x, and marks them as unregistered.
• Finds codes by number, by class or by words, so you do not need to know the number before you search.

Limits

• The advice follows the standards. Some APIs use codes differently, such as 200 with an error in the body or 404 in place of 403, and only their documentation says so.
• Vendor-specific codes beyond the common nginx and Cloudflare ones, such as IIS sub-statuses or AWS load balancer codes, are not listed.

Frequently asked questions

What is the difference between 401 and 403?

401 means the server does not know who you are: there are no credentials, or they are invalid or expired, and logging in may fix it. 403 means the server knows who you are and still refuses. Logging in again will not help, because the account lacks permission.

Should a redirect be 301, 302, 307 or 308?

Use 301 or 308 for a permanent move and 302 or 307 for a temporary one. The pairs differ in what happens to the method: browsers may turn a POST into a GET on 301 and 302, and must keep it on 307 and 308. For pages, 301 and 302 are fine. For APIs, use 308 and 307.

Is 422 or 400 right for a validation error?

Both are common. 400 is the general code for a request the server will not process. 422 says more precisely that the body parsed but its contents broke a rule. Many APIs use 422 for field validation and keep 400 for bodies that cannot be read at all. Pick one and use it consistently.

What does a 502 or 504 mean I should check?

Both come from a proxy or load balancer, not from your application. A 502 means the application sent back something invalid or closed the connection, so check that it is running and has not crashed. A 504 means it did not answer in time, so check what is slow before raising the proxy's timeout.

Related tools

• HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
• cURL Builder — Build an HTTP request and get it as curl, JavaScript, TypeScript, Go, Python, PHP, C#, Java and more
• HAR Analyzer — A network recording as a waterfall: what was slow, heavy, uncached or failing
• Broken Link Checker — Dead links, redirects and missing images on a page
• HTML Formatter — Indent and tidy HTML markup
• CSS Formatter — Format stylesheets with consistent indentation

More Web Development tools

• HTML Formatter — Indent and tidy HTML markup
• CSS Formatter — Format stylesheets with consistent indentation
• JavaScript Formatter — Re-indent JavaScript and TypeScript source
• SCSS/SASS Formatter — Format SCSS syntax and nested rules
• TypeScript Formatter — Format TypeScript source code
• SQL Formatter — Format SQL statements with dialect selection
• SQL Minifier — Collapse formatted SQL into compact text
• CSS Unit Converter — px, rem, em, percentages and viewport units, with a preview
• Query String Parser and Builder — Convert query strings into editable key-value data
• CSP Generator — Build a Content-Security-Policy, or check one, and write it for your server or framework
• CORS Generator — Write CORS configuration for nginx, Express, Go, Django, ASP.NET, Spring and more, and test an origin against it
• cURL Builder — Build an HTTP request and get it as curl, JavaScript, TypeScript, Go, Python, PHP, C#, Java and more
• Minifier — Shrink CSS, HTML or JavaScript
• Flexbox Playground — Try every flex property and read the CSS back
• CSS Grid Playground — Build a grid template and see the tracks it makes
• Responsive Viewport Tester — Render your markup at phone, tablet and desktop widths
• SVG Path Viewer — Draw path data and read back what it contains
• SVG to CSS Converter — Turn an SVG into a data URI for CSS or an img tag
• OAuth 2.0 / OIDC Helper — PKCE verifiers and challenges, state, nonce, and checking what came back
• Regex Tester — Test patterns, inspect groups and preview replacements
• User-Agent Parser — Identify the browser, engine, operating system and device behind a User-Agent string
• HTML to JSX — Convert HTML and SVG markup into JSX for React, with styles, attributes and whitespace handled
• Semver Checker — Test versions against npm ranges, sort them by precedence, and see what each bump produces
• Cookie Parser and Builder — Read Set-Cookie and Cookie headers, check them against browser rules, and write one for your framework