Home/
HTTP Status Codes & Header Tester

Interactive HTTP Status Codes Reference & Header Tester

Comprehensive directory of 1xx to 5xx response codes with official RFC 9110 specifications, caching directives, real-world troubleshooting guides (403 vs 401, 502 bad gateway fix), and instant client-side header simulation.

Group:
Quick Jump:
Found 53 status codesTap to inspect
100Continue
1xx

Client may proceed with sending the request payload body.

RFC 9110 §15.2.1Non-cacheable
101Switching Protocols
1xx

Server accepted protocol upgrade request (e.g., HTTP to WebSocket).

RFC 9110 §15.2.2Non-cacheable
102Processing
1xx

Server has accepted the full request but is still generating response.

RFC 2518 (WebDAV)Non-cacheable
103Early Hints
1xx

Allows client to preload critical CSS/JS while server generates HTML.

RFC 8297Non-cacheable
200OK
2xx

Standard response for successful HTTP requests with payload.

RFC 9110 §15.3.1Cacheable
201Created
2xx

Request succeeded and led to the creation of a new resource.

RFC 9110 §15.3.2Non-cacheable
202Accepted
2xx

Request accepted for async processing, but execution has not finished.

RFC 9110 §15.3.3Non-cacheable
203Non-Authoritative Information
2xx

Request succeeded, but payload headers modified by transforming proxy.

RFC 9110 §15.3.4Cacheable
204No Content
2xx

Request succeeded, but server intentionally returns zero payload body.

RFC 9110 §15.3.5Cacheable
205Reset Content
2xx

Server fulfilled request and desires client to reset document view (clear form).

RFC 9110 §15.3.6Non-cacheable
206Partial Content
2xx

Delivering only a byte-range portion of the resource requested.

RFC 9110 §15.3.7Cacheable
207Multi-Status
2xx

Conveys information about multiple resources in XML message body.

RFC 4918 (WebDAV)Non-cacheable
301Moved Permanently
3xx

Resource permanently moved to new URI; passes SEO link equity.

RFC 9110 §15.4.2Cacheable
302Found
3xx

Temporary redirect; client should continue using original URI.

RFC 9110 §15.4.3Non-cacheable
303See Other
3xx

Explicitly redirects client to GET a separate resource (Post/Redirect/Get).

RFC 9110 §15.4.4Non-cacheable
304Not Modified
3xx

Client cached copy is fresh; reuse cached entity (saves bandwidth).

RFC 9110 §15.4.5Non-cacheable
307Temporary Redirect
3xx

Temporary redirect GUARANTEEING HTTP method and body are preserved.

RFC 9110 §15.4.8Non-cacheable
308Permanent Redirect
3xx

Permanent redirect GUARANTEEING HTTP method and body are preserved.

RFC 9110 §15.4.9Cacheable
400Bad Request
4xx

Server cannot process request due to malformed syntax or bad parameters.

RFC 9110 §15.5.1Non-cacheable
401Unauthorized
4xx

Authentication credentials missing or invalid; MUST send WWW-Authenticate.

RFC 9110 §15.5.2Non-cacheable
402Payment Required
4xx

Reserved for digital payment schemes, SaaS paywalls, or depleted credit balances.

RFC 9110 §15.5.3Non-cacheable
403Forbidden
4xx

Server understood request, but explicitly refuses authorization.

RFC 9110 §15.5.4Non-cacheable
404Not Found
4xx

Origin server did not find a current representation for target resource.

RFC 9110 §15.5.5Cacheable
405Method Not Allowed
4xx

Target URI exists, but requested HTTP method is unsupported; MUST send Allow.

RFC 9110 §15.5.6Non-cacheable
406Not Acceptable
4xx

Resource cannot generate response matching client Accept headers.

RFC 9110 §15.5.7Non-cacheable
408Request Timeout
4xx

Server timed out waiting for client to finish sending request message.

RFC 9110 §15.5.9Non-cacheable
409Conflict
4xx

Request could not be processed due to a conflict with current resource state.

RFC 9110 §15.5.10Non-cacheable
410Gone
4xx

Resource was intentionally and PERMANENTLY deleted; search engines de-index.

RFC 9110 §15.5.11Cacheable
412Precondition Failed
4xx

One or more conditions given in request header fields evaluated to false.

RFC 9110 §15.5.13Non-cacheable
413Payload Too Large
4xx

Request body payload exceeds maximum size limit configured on server.

RFC 9110 §15.5.14Non-cacheable
414URI Too Long
4xx

Target URI exceeds length server is willing to interpret.

RFC 9110 §15.5.15Non-cacheable
415Unsupported Media Type
4xx

Request payload format/content-type is not supported by endpoint.

RFC 9110 §15.5.16Non-cacheable
418I'm a teapot
4xx

HTCPCP protocol Easter egg defined on April Fools' Day 1998.

RFC 2324 / RFC 9110 §15.5.19Non-cacheable
422Unprocessable Content
4xx

Request syntax is valid JSON, but contains semantic validation errors.

RFC 9110 §15.5.21Non-cacheable
426Upgrade Required
4xx

Server refuses request using current protocol; requires protocol upgrade.

RFC 9110 §15.5.22Non-cacheable
429Too Many Requests
4xx

User has sent too many requests in a given amount of time (rate limited).

RFC 6585Non-cacheable
431Request Header Fields Too Large
4xx

Server refuses request because individual or total header fields are too large.

RFC 6585Non-cacheable
451Unavailable For Legal Reasons
4xx

Resource blocked due to legal demand, DMCA takedown, or government censorship.

RFC 7725Cacheable
500Internal Server Error
5xx

Generic catch-all server crash or unhandled runtime code exception.

RFC 9110 §15.6.1Non-cacheable
501Not Implemented
5xx

Server does not support functionality required to fulfill request.

RFC 9110 §15.6.2Non-cacheable
502Bad Gateway
5xx

Reverse proxy (Nginx/Cloudflare) received an invalid response from upstream.

RFC 9110 §15.6.3Non-cacheable
503Service Unavailable
5xx

Server currently unable to handle request due to temporary maintenance or load.

RFC 9110 §15.6.4Non-cacheable
504Gateway Timeout
5xx

Reverse proxy timed out waiting for upstream server to complete request.

RFC 9110 §15.6.5Non-cacheable
505HTTP Version Not Supported
5xx

Server does not support the HTTP major version used in request.

RFC 9110 §15.6.6Non-cacheable
507Insufficient Storage
5xx

Server is unable to store the representation needed to complete request.

RFC 4918 (WebDAV)Non-cacheable
508Loop Detected
5xx

Server terminated operation because it encountered an infinite loop.

RFC 5842 (WebDAV)Non-cacheable
511Network Authentication Required
5xx

Client needs to authenticate to gain network access (captive portal).

RFC 6585Non-cacheable
520Web Server Returned an Unknown Error
edge

Catch-all 520 when origin server sent an empty, unknown, or corrupted response.

Cloudflare ExtensionNon-cacheable
521Web Server Is Down
edge

Cloudflare successfully resolved origin IP, but origin refused connection.

Cloudflare ExtensionNon-cacheable
522Connection Timed Out
edge

Cloudflare could not complete TCP handshake with origin server within 15s.

Cloudflare ExtensionNon-cacheable
523Origin Is Unreachable
edge

Cloudflare cannot reach origin server due to network routing failure.

Cloudflare ExtensionNon-cacheable
524A Timeout Occurred
edge

Cloudflare connected to origin, but origin took over 100s to send HTTP response.

Cloudflare ExtensionNon-cacheable
525SSL Handshake Failed
edge

Cloudflare could not negotiate a successful TLS/SSL handshake with origin.

Cloudflare ExtensionNon-cacheable
403

Forbidden

4xx ClassRFC 9110 §15.5.4
CacheabilityNon-cacheable
Safe Method ContextSafe (Read-only)
IdempotencyIdempotent

Protocol Specifications & Meaning

Indicates that the server understood the request but refuses to authorize it. Unlike 401 Unauthorized, re-authenticating with the same credentials will make no difference because the user's role, IP, WAF, or scopes do not have permission for the resource.

Common Causes & Real-World Scenarios

  • •User is authenticated, but lacks 'admin' or required RBAC permission scope.
  • •CORS Preflight origin blocked or forbidden.
  • •Cloudflare WAF / AWS Shield IP geo-blocking rule triggered.
  • •Missing CSRF token on state-changing POST request.
  • •File permission 403 Forbidden on Linux Nginx (worker user cannot read static folder).

Troubleshooting & Developer Resolution Guide

1.Verify user token permissions/scopes ('role: admin' missing).
2.Check CORS origin whitelist in backend config.
3.Check Nginx file system permissions: ensure 'chmod 755 /var/www' and files are 644.
4.If behind Cloudflare, inspect Security Events log for WAF firewall triggers.

Wire HTTP Response Preview

HTTP/1.1 403 Forbidden
Content-Type: application/json
Content-Length: 104

{
  "error": "forbidden",
  "message": "You lack the required 'billing:write' permission scope."
}

Server Implementation Example

if (!req.user.roles.includes('admin')) {
  return res.status(403).json({ error: 'Insufficient permissions' });
}

HTTP Protocol Architecture & Troubleshooting FAQ

Essential references for web developers, DevOps engineers, and system architects.

Why does RFC 9110 replace older RFC 7231 and RFC 2616?

Published in June 2022, RFC 9110 (HTTP Semantics) is the definitive contemporary standard for the HTTP protocol. It clarifies ambiguity in earlier RFCs, standardizes caching semantics (RFC 9111), and formalizes behavior across HTTP/1.1, HTTP/2, and HTTP/3 multiplexed streams.

Why should 401 Unauthorized always send WWW-Authenticate?

RFC 9110 §15.5.2 requires that an origin server send a WWW-Authenticate challenge header in 401 responses. This tells the client which authentication scheme (Bearer, Basic, Digest, DPoP) and realm are expected, enabling automated client token renewal.

What is the difference between 502 Bad Gateway and 504 Gateway Timeout?

In a 502, the reverse proxy reached the upstream server, but the upstream immediately refused the connection or returned corrupted data (often crashed). In a 504, the upstream accepted connection, but took longer than the proxy read timeout (e.g. 60 seconds) to complete.

Are response headers inspected safely in this tool?

Yes. In strict compliance with ToolsAA development guidelines, this page runs 100% on the client side ('use client'). No headers, tokens, cookies, or payloads are ever dispatched to external servers. Inspection takes place solely within your browser memory.