HTTP Status Code Reference

Search 31 common status codes. 401 vs 403 and 502 vs 503 included.

Code	Name	Meaning
100	Continue	The client should continue sending the request body.
101	Switching Protocols	The server is switching protocols as requested (for example, to WebSocket).
102	Processing	WebDAV: the server has received the request and is processing it.
200	OK	The request succeeded. The most common success code for GET and POST.
201	Created	A new resource was created. Typical for successful POST to a collection.
202	Accepted	The request was accepted for processing but is not complete yet.
204	No Content	Success with an empty body. Common for DELETE and some PUT/PATCH responses.
206	Partial Content	A range request succeeded. Used for resumable downloads.
301	Moved Permanently	The resource has a new permanent URI. Clients and search engines should update links.
302	Found	Temporary redirect. The original URI is still valid.
303	See Other	Redirect the client to retrieve the result with GET (Post/Redirect/Get).
304	Not Modified	Cached representation is still valid. Do not resend the body.
307	Temporary Redirect	Temporary redirect that must preserve the original HTTP method.
308	Permanent Redirect	Permanent redirect that must preserve the original HTTP method.
400	Bad Request	The server cannot process the request due to a client error (malformed JSON, missing fields).
401	Unauthorized	Authentication is required or failed. Send credentials. Not the same as 403.
403	Forbidden	The client is authenticated but not allowed to access this resource.
404	Not Found	No resource at this URI. Also used to hide existence of private resources.
405	Method Not Allowed	The HTTP method is not supported for this resource. Check Allow header.
408	Request Timeout	The server timed out waiting for the request.
409	Conflict	The request conflicts with current state (duplicate, version mismatch).
410	Gone	The resource used to exist and is intentionally gone.
412	Precondition Failed	An If-Match / If-Unmodified-Since precondition was not met.
415	Unsupported Media Type	The Content-Type is not supported. Typical for JSON APIs receiving form data.
422	Unprocessable Entity	The body is syntactically valid but semantically invalid (validation errors).
429	Too Many Requests	Rate limited. Respect Retry-After if present.
500	Internal Server Error	An unexpected error on the origin server. The client did nothing wrong.
501	Not Implemented	The server does not support the requested method or feature.
502	Bad Gateway	A proxy or gateway got an invalid response from upstream.
503	Service Unavailable	The origin is overloaded, down, or in maintenance. Often retryable.
504	Gateway Timeout	A proxy timed out waiting for upstream.

Easy to mix up

401 vs 403: 401 means not authenticated (missing or bad credentials). 403 means authenticated but not allowed.

502 vs 503: 502 means a proxy got a bad response from upstream. 503 means the origin itself is unavailable or overloaded.

Related Tools

H> HTTP Header Analyzer

Analyze HTTP headers for security issues, caching behavior, and CORS configuration with fix snippets.

CS CSP Builder

Build and analyze Content-Security-Policy headers visually. Generate directives, detect security issues.

OG OG Tag Preview

Preview how your page looks on Google, Facebook, Twitter/X, and LinkedIn.