HTTP Status Codes

Every HTTP status code with its reason phrase, whether it is cacheable, whether it can carry a body, and when to use it.

What are HTTP status codes?

Every HTTP response starts with a three-digit status code that tells the client how the request went. The first digit defines the class:

1xx — informational: the server received the request and is continuing.
2xx — success: the request was received and processed.
3xx — redirection: the client must take an extra step, usually following a redirect.
4xx — client error: the request is malformed or not allowed.
5xx — server error: the server failed to fulfil an otherwise valid request.

How to read the table

The table is grouped by class. Two of its columns come straight from the specification rather than from opinion:

Cacheable — whether a cache may reuse the response by default. RFC 9110 defines exactly twelve codes as heuristically cacheable: 200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414 and 501. Every other code is only cached when the response says so explicitly.
Body — whether the response may carry a body. The whole 1xx class cannot contain content, 204 and 304 send no representation, and 205 must not generate content.

Use the search box to filter by code, reason phrase or description. To see which code a live site actually returns — including every redirect — use the Website Status Checker.

Which code should you return?

The table tells you what a code means. This is the other half: what to send.

Creating a resource

Situation	Code
You created a new resource	`201 Created` — include a `Location` header
You accepted work to do later	`202 Accepted`
It worked and there is nothing to return	`204 No Content`
It worked and the client keeps its current view	`200 OK`

Redirects

Code	Permanent?	Preserves the method?
`301`	Yes	No — a `POST` becomes a `GET`
`302`	No	No — same problem, and it is the accidental default
`303`	No	No — that is the point: “look over there, with `GET`”
`307`	No	Yes
`308`	Yes	Yes

Moving a GET-only URL permanently: 301. Moving an endpoint where the method and body matter: 308 if permanent, 307 if temporary. Avoid 302 for a permanent move — browsers treat it as temporary and signals do not transfer.

Client errors

Code	Use it when
`400`	The request is malformed and authenticating would not help
`401`	The client is not authenticated — send `WWW-Authenticate`
`403`	The client is authenticated but not allowed; retrying will not help
`404`	The resource does not exist, or you do not want to reveal that it does
`405`	The method is wrong for this URL — send `Allow`
`409`	The request conflicts with the current state (duplicate key, stale version)
`422`	The body parses but fails validation
`429`	Rate limited — send `Retry-After`

The pair people get wrong most often is 401 versus 403: 401 asks “who are you?”, 403 says “I know who you are, and no”.

Server errors

500 is the catch-all for a bug. When you can be precise, be precise: 502 and 504 mean an upstream service answered badly or too slowly, and 503 means you are overloaded or in maintenance — and only 503 lets you send Retry-After so clients back off politely instead of hammering you.

Codes that carry no body

1xx, 204, 205 and 304 cannot carry a body. Sending one is a protocol error, not just wasted bytes. 304 is the easiest to get wrong: it must not repeat the body of the 200 it replaces, only the headers the cache needs to update.

Sources

Reason phrases and cacheability follow the IANA HTTP Status Code Registry and RFC 9110 (HTTP Semantics). Legacy codes that are no longer in use (305 Use Proxy, 306 Switch Proxy) are omitted on purpose.

Code	Reason phrase	Cacheable	Body	Description
1xx · Informational
`100`	`Continue`	`No`	`No`	The server received the request headers and the client can proceed with the body.
`101`	`Switching Protocols`	`No`	`No`	The server agrees to switch protocols, for example to WebSockets.
`102`	`Processing`	`No`	`No`	The server is still working on the request (WebDAV) and no final response is available yet.
`103`	`Early Hints`	`No`	`No`	Sends preliminary headers (for example Link preload hints) before the final response.
2xx · Success
`200`	`OK`	`Yes`	`Yes`	The request succeeded; the meaning of the body depends on the HTTP method used.
`201`	`Created`	`No`	`Yes`	The request succeeded and a new resource was created (typical response to POST).
`202`	`Accepted`	`No`	`Yes`	The request was accepted for processing, but the processing is not complete yet.
`203`	`Non-Authoritative Information`	`Yes`	`Yes`	The response came from a transforming proxy, not the origin server.
`204`	`No Content`	`Yes`	`No`	The request succeeded but there is no body to return (common for DELETE).
`205`	`Reset Content`	`No`	`No`	Like 204, but asks the client to reset the document view that sent the request.
`206`	`Partial Content`	`Yes`	`Yes`	The server returned only part of the resource, requested via a Range header.
`207`	`Multi-Status`	`No`	`Yes`	Conveys multiple independent statuses in one body (WebDAV).
`208`	`Already Reported`	`No`	`Yes`	Avoids re-listing members of a WebDAV collection already reported earlier.
`226`	`IM Used`	`No`	`Yes`	The server fulfilled a GET for the resource after applying delta encoding.
3xx · Redirection
`300`	`Multiple Choices`	`Yes`	`Yes`	The request has more than one possible response; the client should choose one.
`301`	`Moved Permanently`	`Yes`	`Yes`	The resource moved permanently to a new URL; update your links.
`302`	`Found`	`No`	`Yes`	The resource is temporarily at another URL (historically “Moved Temporarily”).
`303`	`See Other`	`No`	`Yes`	The response can be found at another URL, retrieved with a GET request.
`304`	`Not Modified`	`No`	`No`	The cached copy is still valid; used with conditional requests and caching.
`307`	`Temporary Redirect`	`No`	`Yes`	Temporary redirect that preserves the HTTP method and body.
`308`	`Permanent Redirect`	`Yes`	`Yes`	Permanent redirect that preserves the HTTP method and body.
4xx · Client error
`400`	`Bad Request`	`No`	`Yes`	The server cannot process the request due to malformed syntax.
`401`	`Unauthorized`	`No`	`Yes`	Authentication is required, and has failed or not been provided.
`402`	`Payment Required`	`No`	`Yes`	Reserved for future use; originally intended for digital payment systems.
`403`	`Forbidden`	`No`	`Yes`	The server understood the request but refuses to authorize it.
`404`	`Not Found`	`Yes`	`Yes`	The server cannot find the requested resource; the URL may be wrong.
`405`	`Method Not Allowed`	`Yes`	`Yes`	The HTTP method is not supported for the requested resource.
`406`	`Not Acceptable`	`No`	`Yes`	The server cannot produce a response matching the Accept headers.
`407`	`Proxy Authentication Required`	`No`	`Yes`	Authentication with a proxy is required before the request can continue.
`408`	`Request Timeout`	`No`	`Yes`	The server timed out waiting for the request from the client.
`409`	`Conflict`	`No`	`Yes`	The request conflicts with the current state of the resource.
`410`	`Gone`	`Yes`	`Yes`	The resource is permanently gone and no forwarding address is known.
`411`	`Length Required`	`No`	`Yes`	The server requires a Content-Length header in the request.
`412`	`Precondition Failed`	`No`	`Yes`	A precondition given in the request headers evaluated to false.
`413`	`Payload Too Large`	`No`	`Yes`	The request body is larger than the server is willing to process.
`414`	`URI Too Long`	`Yes`	`Yes`	The request URI is longer than the server is willing to interpret.
`415`	`Unsupported Media Type`	`No`	`Yes`	The request has a media format the server does not support.
`416`	`Range Not Satisfiable`	`No`	`Yes`	The requested byte range cannot be satisfied for the resource.
`417`	`Expectation Failed`	`No`	`Yes`	The server cannot meet the expectation given in the Expect header.
`418`	`I'm a Teapot`	`No`	`Yes`	April Fools’ RFC 2324; the server refuses to brew coffee because it is a teapot.
`421`	`Misdirected Request`	`No`	`Yes`	The request was sent to a server that cannot produce a response.
`422`	`Unprocessable Content`	`No`	`Yes`	The request was well-formed but contains semantic errors (WebDAV; common in APIs).
`423`	`Locked`	`No`	`Yes`	The resource being accessed is locked (WebDAV).
`424`	`Failed Dependency`	`No`	`Yes`	The request failed because a previous request it depended on failed (WebDAV).
`425`	`Too Early`	`No`	`Yes`	The server refuses to process a request that might be replayed.
`426`	`Upgrade Required`	`No`	`Yes`	The server requires the client to upgrade to a different protocol.
`428`	`Precondition Required`	`No`	`Yes`	The server requires the request to be conditional to avoid lost updates.
`429`	`Too Many Requests`	`No`	`Yes`	The client sent too many requests in a given time (rate limiting).
`431`	`Request Header Fields Too Large`	`No`	`Yes`	The request headers are too large for the server to process.
`451`	`Unavailable For Legal Reasons`	`No`	`Yes`	The resource is unavailable due to legal demands (censorship or copyright).
5xx · Server error
`500`	`Internal Server Error`	`No`	`Yes`	The server hit an unexpected condition and cannot fulfil the request.
`501`	`Not Implemented`	`Yes`	`Yes`	The server does not support the functionality required to fulfil the request.
`502`	`Bad Gateway`	`No`	`Yes`	The server, acting as a gateway, received an invalid response upstream.
`503`	`Service Unavailable`	`No`	`Yes`	The server is temporarily unable to handle the request (overload or maintenance).
`504`	`Gateway Timeout`	`No`	`Yes`	The server, acting as a gateway, did not get a response from upstream in time.
`505`	`HTTP Version Not Supported`	`No`	`Yes`	The server does not support the HTTP version used in the request.
`506`	`Variant Also Negotiates`	`No`	`Yes`	Transparent content negotiation ended in a configuration loop.
`507`	`Insufficient Storage`	`No`	`Yes`	The server cannot store what is needed to complete the request (WebDAV).
`508`	`Loop Detected`	`No`	`Yes`	The server detected an infinite loop while processing the request (WebDAV).
`510`	`Not Extended`	`No`	`Yes`	Further extensions to the request are required for the server to fulfil it.
`511`	`Network Authentication Required`	`No`	`Yes`	The client must authenticate to gain network access (for example a captive portal).

Website Status Checker