- Home
- Free tools
- HTTP status codes
HTTP status codes reference
Every common HTTP status code from 1xx to 5xx in plain language, with what to do when your uptime monitor sees it, including nginx and Cloudflare errors. Free, searchable.
The verdict column shows how a Tenium HTTP monitor treats the code with default settings: expected status 200 to 299, redirects followed. You can change the expected statuses per monitor.
53 of 53 codes
| Code | Name | What it means | What to do when your monitor sees it | Default monitor verdict |
|---|---|---|---|---|
| 100 | Continue | The server got the request headers and the client may send the body. | You will almost never see it in a monitor: the HTTP client handles it for you. If a check reports it, something between you and the server is sending interim responses oddly. Try the URL with curl -v. | Rarely seen |
| 101 | Switching Protocols | The server agrees to switch protocol, for example to WebSocket. | Expected on a WebSocket endpoint. A plain HTTP monitor is not the right check for it: monitor the page that serves the app, or the port. | Rarely seen |
| 103 | Early Hints | A preliminary response that lets the browser start loading assets before the real answer. | Not a failure. If a monitor shows it, an intermediary is mishandling interim responses; check the final status instead. | Rarely seen |
| 200 | OK | The request succeeded and the response contains the page or data. | Good, but not proof the page is right. WordPress and many apps return 200 with an error message in the body. Add a keyword check for text that only appears on a healthy page. | Up |
| 201 | Created | The request succeeded and created a new resource, usually after a POST. | Normal for an API that creates things. If you monitor a POST endpoint, keep 201 in the expected statuses (the default 200-299 range already includes it). | Up |
| 202 | Accepted | The request was accepted for processing, but is not finished. | Normal for queue-backed APIs. It says nothing about whether the job later succeeds, so pair it with a heartbeat for the job itself. | Up |
| 203 | Non-Authoritative Information | The response is a modified copy from a proxy, not the origin's exact answer. | Rare. A proxy or CDN is rewriting responses. Usually harmless; confirm the body is what you expect. | Up |
| 204 | No Content | The request succeeded and there is deliberately no body. | Fine for APIs and health endpoints. A keyword check cannot work on an empty body, so rely on the status code here. | Up |
| 206 | Partial Content | Only part of the file was returned, because a byte range was requested. | Normal for video and large downloads. A monitor does not send Range headers, so seeing it on a page means a cache or server is behaving unusually. | Up |
| 300 | Multiple Choices | There are several possible responses and the client should choose. | Rare on the web. If your monitor hits it, the URL is ambiguous: link to the specific resource. | Followed |
| 301 | Moved Permanently | The page has a new permanent address. | Update the monitor to the final URL so each check is one request, not two. A redirect chain that ends in 200 counts as up; one that loops or ends in an error does not. | Followed |
| 302 | Found | The page is temporarily at another address. | Common for login redirects and language switches. If the monitor follows it to a login page and the check passes, you are not checking the page you think you are. Point it at a URL that does not redirect. | Followed |
| 303 | See Other | The result is at another URL and should be fetched with GET, typically after a form POST. | Expected after a successful form submission. For a monitor on a POST endpoint, decide whether you want to follow it or judge the 303 itself. | Followed |
| 304 | Not Modified | The cached copy is still valid; no body is sent. | Only appears on conditional requests, which a monitor does not make. If it shows up, a cache layer is answering oddly; check the headers with the HTTP headers tool. | Rarely seen |
| 307 | Temporary Redirect | Temporary redirect that keeps the original method and body. | Often seen when a site forces HTTPS or a domain with HSTS. Monitor the https URL directly to skip the hop. | Followed |
| 308 | Permanent Redirect | Permanent redirect that keeps the original method and body. | Same as 301 for monitoring: switch the monitor to the final address. Check for loops if two rules point at each other. | Followed |
| 400 | Bad Request | The server could not understand the request. | Check the URL for stray characters, a malformed header or an oversized cookie. If it began after a change, a proxy or WAF rule may be rewriting the request. | Down |
| 401 | Unauthorized | Authentication is required or the credentials were wrong. | If the page is meant to be private, add 401 to the expected statuses or add basic-auth credentials to the monitor. If it should be public, an access rule or plugin has locked it. | Down |
| 402 | Payment Required | Reserved for future use; a few services use it for billing problems. | If a hosted service or API returns it, check the account and its billing status with the provider. | Down |
| 403 | Forbidden | The server understood the request but refuses to allow it. | The most common cause for a monitor is a firewall, WAF or security plugin blocking its IP or User-Agent. Allow-list the checker (see the checker IP list). Also check file permissions and directory index settings. | Down |
| 404 | Not Found | The server has nothing at this URL. | The page was deleted, moved or the permalink structure changed. Fix the URL in the monitor or restore the page. A site-wide 404 after an update points to broken rewrite rules. | Down |
| 405 | Method Not Allowed | The URL exists, but not for this HTTP method. | Some endpoints refuse HEAD or GET. Switch the monitor's method to the one the endpoint accepts, usually GET. | Down |
| 406 | Not Acceptable | The server cannot produce a response matching the Accept headers. | Often a WAF or strict content negotiation. Check what Accept header the monitor sends and what the endpoint serves. | Down |
| 408 | Request Timeout | The server gave up waiting for the request. | Usually a slow or overloaded server, or a proxy with a short timeout. Look at server load and the response time chart. | Down |
| 409 | Conflict | The request conflicts with the current state of the resource. | Typical on write APIs. For a monitor it usually means you are calling a write endpoint; use a read-only health URL. | Down |
| 410 | Gone | The page is permanently gone and will not return. | Deliberate, unlike 404. Remove the monitor or point it at the replacement. | Down |
| 413 | Content Too Large | The request body is larger than the server accepts. | Raise the upload limit in the web server and PHP, or shrink the request. Not usually triggered by a monitor. | Down |
| 414 | URI Too Long | The URL is longer than the server accepts. | Shorten the query string in the monitor URL, or look for a redirect loop that keeps appending parameters. | Down |
| 415 | Unsupported Media Type | The server does not accept the content type of the request. | Check the Content-Type header and body of the monitor against what the API expects. | Down |
| 418 | I'm a teapot | A joke status from an April Fools' RFC that some services use deliberately. | Some bot blockers return it to unwanted clients. Treat it as a block and allow-list the monitor. | Down |
| 421 | Misdirected Request | The request reached a server that cannot answer for that host name. | Often a TLS or SNI mismatch behind a shared proxy. Verify the certificate and virtual host for the hostname. | Down |
| 422 | Unprocessable Content | The request was well formed but contains invalid data. | API validation failed. Check the body the monitor sends or switch to a GET health endpoint. | Down |
| 425 | Too Early | The server will not process a request that might be replayed (TLS early data). | Rare. Retry; if persistent, look at TLS 1.3 early-data settings on the proxy. | Down |
| 429 | Too Many Requests | You are being rate-limited. | The server or WAF is throttling the monitor. Allow-list its IPs, lengthen the interval or exclude the URL from rate limits. Do not ignore it: the same limit may hit real visitors. | Down |
| 431 | Request Header Fields Too Large | The headers, often the cookies, are too big. | Clear cookies in the browser to confirm, then raise the header size limit in the web server or proxy. | Down |
| 451 | Unavailable For Legal Reasons | The content is blocked for legal reasons. | Often geo-blocking or a court order. If you expect the block, add 451 to the monitor's expected statuses; otherwise ask who set the rule. | Down |
| 500 | Internal Server Error | The server hit an unexpected error while handling the request. | Read the application and web server error logs first. If it followed a deployment, roll back. In WordPress, disable plugins one by one. | Down |
| 501 | Not Implemented | The server does not support the requested method. | Check that the method is correct and that the server or proxy supports it; try GET. | Down |
| 502 | Bad Gateway | A gateway or proxy got an invalid answer from the server behind it. | The application process behind nginx, a load balancer or a CDN has crashed or restarted. Check that the app service is running and read its log. | Down |
| 503 | Service Unavailable | The server is overloaded or down for maintenance. | Check load, memory and connection limits. If it is planned maintenance, use a maintenance window so it does not count as downtime. | Down |
| 504 | Gateway Timeout | A gateway or proxy timed out waiting for the server behind it. | The application is too slow or hung: slow queries, a stuck worker or a blocked upstream API. Look at response times and the slow-query log. | Down |
| 505 | HTTP Version Not Supported | The server does not support the HTTP version used. | Rare. Check proxy and server protocol settings (HTTP/2, HTTP/3). | Down |
| 507 | Insufficient Storage | The server cannot store what is needed to complete the request. | The disk or quota is full. Free space, then find what is filling it (logs, backups, uploads). | Down |
| 508 | Loop Detected | The server detected an infinite loop. Some shared hosts also use 508 for resource limits. | If you are on shared hosting, the account hit its CPU or process limit: look at traffic and slow plugins. Otherwise look for a rewrite or proxy loop. | Down |
| 511 | Network Authentication Required | The network requires login first, as on captive portals. | The check is going through a captive portal or restricted network. Verify the monitor is reaching the real site. | Down |
| 499 | Client Closed Request (nginx) | nginx logs this when the client closed the connection before the answer was ready. It is not sent to a client. | You will see it in nginx logs, not in a monitor. Many 499s mean the application is slower than visitors are willing to wait. | Down |
| 520 | Web Server Returned an Unknown Error (Cloudflare) | Cloudflare got an empty, oversized or otherwise unexpected response from your origin. | Check the origin's error log, response headers size and whether a firewall is dropping Cloudflare's requests. | Down |
| 521 | Web Server Is Down (Cloudflare) | Cloudflare could not connect to your origin server. | The origin is off, not listening or blocking Cloudflare's IP ranges. Start the service and allow Cloudflare in the firewall. | Down |
| 522 | Connection Timed Out (Cloudflare) | Cloudflare reached your origin but the connection did not complete in time. | The origin is overloaded or a firewall drops packets. Check load, network and the origin firewall. | Down |
| 523 | Origin Is Unreachable (Cloudflare) | Cloudflare cannot find a route to your origin. | Check DNS for the origin address in Cloudflare and that the origin IP is correct and reachable. | Down |
| 524 | A Timeout Occurred (Cloudflare) | The origin accepted the connection but did not answer within Cloudflare's time limit. | A slow request: long-running script, report or export. Speed it up, move it to a background job or answer sooner. | Down |
| 525 | SSL Handshake Failed (Cloudflare) | Cloudflare could not complete a TLS handshake with the origin. | Check that the origin serves HTTPS on 443 with a working certificate and compatible TLS settings. | Down |
| 526 | Invalid SSL Certificate (Cloudflare) | Cloudflare could not validate the origin's certificate in Full (strict) mode. | Renew or replace the origin certificate, or fix the chain. The SSL checker shows what the origin serves. | Down |
No status code matches. Try a number such as 502 or a word such as timeout.
Know the moment a site starts returning one of these. Tenium checks your pages and alerts you when the status code or the page content is wrong. 30 monitors are free.
Start freeHow an uptime monitor judges a status code
A monitor requests a URL and compares the status code with what you told it to expect. In Tenium the default is 200 to 299, and redirects are followed, so a 301 that ends in a 200 counts as up. Anything else, including every 4xx and 5xx, is a failure that is confirmed with a second check before an incident opens.
You can change the expected statuses per monitor: a list such as `200,204`, or a class such as `2xx,3xx`. Do this on purpose, for a private page that rightly answers 401 or for an endpoint that answers 204. Do not do it to silence a monitor that is telling you something.
Codes that are easy to misread
A short list of the ones that cause the most confusion in practice:
- 200 does not mean the page is right. Many applications return 200 with an error message in the body, so add a keyword check for text that only a healthy page contains.
- 301 and 302 are both redirects, but only 301 says the move is permanent. Point the monitor at the final URL so each check is a single request.
- 401 means "who are you?" and 403 means "I know, and no". A monitor that gets 403 on a site that loads in your browser is usually blocked by a firewall or security plugin.
- 502, 503 and 504 all come from the layer in front of the application. 502 is a bad answer, 503 is "unavailable or overloaded", 504 is "too slow". Each points at a different place to look.
- 429 is rate limiting. If your monitor sees it, real visitors may see it too.
Using the table
Type a code or a word to filter, or pick a class with the buttons. Each row says what the code means and what to try first when an uptime monitor reports it. Codes 499 and 520 to 526 are not part of the HTTP standard: nginx and Cloudflare use them, and they appear in logs and error pages on sites behind those tools.
Questions about this tool
What is the difference between 502, 503 and 504?
502 Bad Gateway means a proxy got an invalid answer from the application behind it, often because the app crashed. 503 Service Unavailable means the server is overloaded or in maintenance. 504 Gateway Timeout means the application did not answer in time. Check the process, the load and the slow requests, in that order.
Should a monitor treat a 3xx redirect as up?
A redirect is a normal answer, but what matters is where it ends. Tenium follows redirects and judges the final response, so a chain that ends in 200 is up and a loop or an error at the end is down. Monitor the final URL where you can.
Why does my monitor get 403 when the site works in my browser?
A firewall, WAF or security plugin is blocking the monitor's IP address or User-Agent. Allow-list the checker addresses listed on the checker IP page and the monitor will be treated like a normal visitor.
Can I change which status codes count as up?
Yes. Each HTTP monitor has an expected status setting. Use a list such as 200,204 or a class such as 2xx,3xx. The default is 200 to 299.
More free tools
Is it down?Check a site from 2 regionsUptime calculatorTurn 99.9% into minutesCron expression builderBuild and explain cron schedulesSSL checkerCertificate expiry and chainDNS lookupEvery common record in one checkHTTP headersInspect response headersDomain expiryWhen does a domain expire?Subnet calculatorCIDR to ranges and masksResponse time testLatency from 2 regionsUptime badgeSVG badge for your READMESPF, DKIM and DMARC checkerIs your domain’s email authenticated?