HTTP status code reference

Every code a browser realistically shows you, what it means in practice, and the only thing most people want to know: Is this yours to fix, or theirs, and will waiting help?

The short answer: A code starting with 4 is usually about your request, your session or your network. A code starting with 5 is the server failing, and nothing you do will change it. That one digit settles most of the question.

Filter by code or meaning

Their problem Your problem Could be either

2xx Success

The request worked. If the page still looks wrong, the problem is in the page rather than the request.

Code	Name	Whose	What it means
200	OK	theirs	The normal answer. The server had the thing and sent it.
201	Created	theirs	Something was created, usually after a form or an API call.
204	No Content	theirs	Worked, and there is deliberately nothing to show.
206	Partial Content	theirs	A range of a file, which is how video seeking and resumed downloads work.

3xx Redirection

The thing moved. Your browser follows these automatically, so you only notice when they loop.

Code	Name	Whose	What it means
301	Moved Permanently	theirs	The new address is permanent, and search engines transfer the old page’s value to it.
302	Found	theirs	A temporary move. The old address stays the canonical one.
304	Not Modified	either	Your cached copy is still current, so nothing was sent. A stale cache here is why a page will not update.
307	Temporary Redirect	theirs	Like a 302, but the method is preserved, so a POST stays a POST.
308	Permanent Redirect	theirs	Like a 301, with the method preserved.

4xx Your side of the conversation

The server understood and refused. Most of these are about your request, your session or your network rather than the server being broken.

Code	Name	Whose	What it means
400	Bad Request	yours	The request was malformed. Often an oversized cookie; clearing cookies for the site fixes it.
401	Unauthorized	yours	You are not signed in, or the session expired. Sign in again.
403	Forbidden	either	You are not allowed. Also what most bot walls and country blocks return, so a VPN can cause it.
404	Not Found	theirs	No such address. A broken link, or the page was removed.
405	Method Not Allowed	theirs	The address exists but not for that kind of request.
408	Request Timeout	yours	You took too long to send the request. Usually a poor connection.
410	Gone	theirs	Deliberately removed and not coming back, unlike a 404.
413	Payload Too Large	yours	The file you uploaded exceeds the limit.
418	I'm a Teapot	either	A joke from a 1998 April Fools protocol. Occasionally used as a deliberate brush-off.
429	Too Many Requests	either	Rate limited. Waiting genuinely is the fix; retrying faster makes it last longer.
451	Unavailable For Legal Reasons	theirs	Blocked by a legal order. A VPN sometimes reaches it, depending on where the order applies.

5xx Their side of the conversation

The server failed. Nothing at your end will change the answer, and this is the family that means a genuine outage.

Code	Name	Whose	What it means
500	Internal Server Error	theirs	The application crashed. The catch-all when nothing more specific fits.
501	Not Implemented	theirs	The server does not support what was asked.
502	Bad Gateway	theirs	A proxy or CDN reached the origin server and got nonsense back. Classic sign of a deploy going wrong.
503	Service Unavailable	theirs	Overloaded or in maintenance. Often deliberate, and usually short.
504	Gateway Timeout	theirs	A proxy waited for the origin and gave up. Suggests something behind the site is stuck rather than crashed.
507	Insufficient Storage	theirs	The server ran out of disk.
508	Loop Detected	theirs	The server caught itself in an infinite loop.

5xx Cloudflare-specific

Cloudflare invents its own codes above 520 to say which part failed. They are worth learning because they tell you whether the origin or the edge is at fault.

Code	Name	Whose	What it means
520	Unknown Error	theirs	The origin returned something Cloudflare could not parse.
521	Web Server Is Down	theirs	The origin refused Cloudflare’s connection outright.
522	Connection Timed Out	theirs	The origin never completed the connection.
523	Origin Is Unreachable	theirs	Cloudflare could not route to the origin at all, often a DNS problem.
524	A Timeout Occurred	theirs	The origin connected but took too long to answer.
525	SSL Handshake Failed	theirs	Cloudflare and the origin could not agree on TLS.
526	Invalid SSL Certificate	theirs	The origin’s certificate did not validate.

How to use a status code

Read the first digit first

It tells you who failed before the rest of the number tells you how. A 4xx means the server understood you and declined; a 5xx means it could not answer at all. Everything else is detail.

Check whether you see it from elsewhere

A 403 that everyone gets is a block. A 403 only you get is usually a VPN, a country restriction or a bot filter reacting to your connection. Running the site through our checker settles it in one request, because we ask from a different network than yours.

Know which ones reward waiting

429 and 503 are explicitly temporary and retrying slowly is the correct response. 500 and 502 need somebody to deploy a fix. 404 and 410 will not change however long you wait.

Codes that mean a deploy went wrong

502 and 504 from a site that worked an hour ago almost always mean a release is in progress or has failed. They resolve when a human notices, which is why outage length clusters the way it does. The long-form guides on each error code go through the causes one at a time.