132 HTTP status codes and headers
What 404 and 500 actually mean, and what Content-Type or Cache-Control do — one line each.
Status codes
1xx Informational4
A progress note; the real answer follows.
100 ContinueThe first part of the request arrived; go ahead and send the rest.101 Switching ProtocolsThe connection is switching protocol — this is how a WebSocket begins.102 ProcessingStill working — please wait. Used for operations that take a long time.103 Early HintsSends hints ahead of the body so the browser can start fetching resources early.
2xx Success10
The request went through.
200 OKThe request succeeded — the most common response of all.201 CreatedA new resource was created; the Location header carries its address.202 AcceptedThe request was accepted but has not been carried out yet.203 Non-Authoritative InformationThe answer was modified by a proxy rather than coming straight from the origin.204 No ContentSuccess, but there is nothing to send back — handy after a save when the page should not change.205 Reset ContentSuccess — and the client should clear the form it sent.206 Partial ContentOnly the requested slice was sent — this is what makes resumable downloads and video seeking work.207 Multi-StatusCarries the results for several resources in one response.208 Already ReportedAlready reported earlier in the response, so it is not repeated.226 IM UsedOnly the differences from the requested resource were sent.
3xx Redirection8
Go somewhere else — the distinction is permanent versus temporary.
300 Multiple ChoicesThere is more than one possible resource to choose from.301 Moved PermanentlyThe address moved for good; search ranking follows to the new URL.302 FoundGo elsewhere for now; the original address stays valid.303 See OtherFetch the result from another URL with GET — the usual answer after a form submission.304 Not ModifiedWhat you have is still current — reuse it. No body is sent, which is what makes caching fast.307 Temporary RedirectA temporary move that keeps the original method — a POST stays a POST.308 Permanent RedirectA permanent move that keeps the original method.305 Use ProxyTells the client to reach the resource through a proxy; deprecated for security reasons.
4xx Client error29
The problem is on the request side; sending the same thing again will fail again.
400 Bad RequestThe request itself is malformed and cannot be read.401 UnauthorizedYou have not said who you are; signing in usually resolves it.402 Payment RequiredPayment is required — reserved in the standard but rarely used in practice.403 ForbiddenThe server knows who you are and still says no; signing in may not change it.404 Not FoundNothing lives at that address — the URL is wrong or the page is gone.405 Method Not AllowedThe address exists but does not accept that method.406 Not AcceptableThe server cannot produce the format you asked for.407 Proxy Authentication RequiredA proxy in between wants authentication first.408 Request TimeoutThe server waited and the request never finished arriving.409 ConflictThe request clashes with the current state — typical of two edits at once.410 GoneDeliberately removed and not coming back — a clearer goodbye than 404.411 Length RequiredThe request must state its body length and did not.412 Precondition FailedA condition attached to the request did not hold.413 Content Too LargeThe body you sent is larger than the server accepts.414 URI Too LongThe URL is too long — usually the result of piling on query parameters.415 Unsupported Media TypeThe server cannot handle the media type you sent.416 Range Not SatisfiableThe requested byte range lies outside the file.417 Expectation FailedThe expectation given in the Expect header cannot be met.418 I'm a teapotA joke code: the teapot refuses to brew coffee. It began as an April Fools RFC.421 Misdirected RequestThis server is not the right one to answer that request.422 Unprocessable ContentThe syntax is fine but the content breaks the rules, so it cannot be processed.423 LockedThe resource is locked.424 Failed DependencyAn earlier request failed, so this one cannot go ahead either.425 Too EarlyThe server will not risk processing a request that might be a replay.426 Upgrade RequiredYou must switch to a different protocol to continue.428 Precondition RequiredThe request must carry a condition — this is how lost updates are prevented.429 Too Many RequestsYou sent too many requests; Retry-After says when to try again.431 Request Header Fields Too LargeThe headers are too large — often the result of accumulated cookies.451 Unavailable For Legal ReasonsBlocked for legal reasons; the number nods to the novel Fahrenheit 451.
5xx Server error11
The problem is on the server side; retrying later is often worth it.
500 Internal Server ErrorSomething broke inside the server; the request itself was fine.501 Not ImplementedThe server does not implement that capability yet.502 Bad GatewayA gateway got a bad answer from the server behind it.503 Service UnavailableThe server cannot take requests right now — maintenance or overload.504 Gateway TimeoutA gateway waited for the server behind it and ran out of time.505 HTTP Version Not SupportedThat HTTP version is not supported.506 Variant Also NegotiatesA server configuration error makes content negotiation loop on itself.507 Insufficient StorageThere is not enough storage left to finish.508 Loop DetectedThe server detected an infinite loop while processing.510 Not ExtendedThe request needs a further extension to be fulfilled.511 Network Authentication RequiredYou must sign in to the network first — the usual sight on public Wi-Fi.
Headers
Request headers55
Headers the browser attaches when it sends to the server.
AcceptTells the server which formats the client can accept.Accept-EncodingLists the compressions the client understands; gzip or br cut transfer size a lot.Accept-LanguageStates the preferred languages; multilingual sites pick a version from it.AuthorizationCarries the credentials that prove who you are — a token or a username and password.CookieSends back the cookies the server set earlier.HostNames the domain being addressed — what lets one server host many sites.If-Modified-SinceAsks for the resource only if it changed after that time.If-None-MatchAsks for the resource only if its ETag differs — this is how a cache revalidates.OriginStates where the request came from; the browser adds it and CORS decisions rest on it.RangeRequests only part of a file — the basis of resumable downloads and video seeking.RefererNames the page you came from; the misspelling was baked into the standard long ago.User-AgentDescribes the browser and device; these strings are mostly camouflage nowadays.Sec-Fetch-DestSays what the request is for — an image, a script, a document.Sec-Fetch-ModeStates whether the request is same-origin, CORS or a navigation.Sec-Fetch-SiteSays whether the request came from the same site or a different one.DNTAsks not to be tracked; it carries no force and is largely ignored.ExpectChecks with the server before sending a large body.ForwardedRecords the original client details of a request that passed through proxies.FromCarries an email address for whoever sent the request; crawlers use it as contact.If-MatchProceed only if the ETag matches — this prevents overwriting someone else’s change.If-RangeResume the download if the file is unchanged; otherwise start over.Max-ForwardsLimits how many proxies a request may pass through.Proxy-AuthorizationCredentials presented to a proxy rather than the origin server.TELists the transfer encodings the client will accept.Upgrade-Insecure-RequestsAsks the server to upgrade any plain http links to https.X-Forwarded-ForCarries the original client IP through proxies; not standard but used everywhere.X-Forwarded-ProtoSays whether the original request arrived over http or https.X-Requested-WithAn old convention marking a request as coming from JavaScript.Accept-CharsetLists the character encodings the client can accept; rarely used today.If-Unmodified-SinceAsks the server to act only if the resource has not changed since that time.Sec-CH-UAReports the browser brand and major version; meant to replace the User-Agent string.Sec-CH-UA-MobileSays only whether the device is a phone; a single true or false flag.Sec-CH-UA-PlatformReports which operating system the request came from; the version is a separate hint.Save-DataTells the server the user wants to save data, so it can send a lighter version.Device-MemoryReports roughly how much memory the device has; the value is deliberately coarse.Early-DataMarks a request that was sent as early data, before the handshake finished.Access-Control-Request-MethodAsks in advance which method the real request will use; only sent on a preflight.Access-Control-Request-HeadersAsks in advance which headers the real request will carry; only sent on a preflight.Sec-PurposeMarks the request as speculative; prefetch means the user has not clicked yet.Sec-CH-UA-ArchReports the CPU architecture, so the server knows whether it is arm or x86.Sec-CH-UA-ModelReports the device model name; in practice only mobile devices fill it in.Sec-CH-UA-Platform-VersionReports the operating system version; it pairs with Sec-CH-UA-Platform.X-Forwarded-HostThe original Host the browser asked for, before a proxy rewrote it.X-Real-IPA proxy passes the original client address here; not standard, but widely used.Alt-UsedTells the server the client switched here because of Alt-Svc, which prevents loops.Sec-WebSocket-KeyA random value sent when asking to upgrade to WebSocket; the server hashes it back.Sec-WebSocket-VersionThe WebSocket protocol version being requested; in practice it is always 13.Last-Event-IDSends the last event id received, so a dropped server-sent event stream can resume.TraceparentCarries the trace id that links one request across every service it passes through.BaggageCarries key–value context that travels with the request across services.Idempotency-KeyA key that lets the server treat a repeated request as the same one — common in payments.PreferTells the server what the client would prefer; the server may or may not honour it.Sec-GPCThe browser’s signal that the user does not want their data sold or shared.Sec-CH-Prefers-Color-SchemeTells the server whether the user prefers a light or dark colour scheme.Sec-CH-UA-Full-Version-ListLists the full versions of the browser and its engines — the replacement for User-Agent.
Response headers56
Headers the server attaches when it answers.
Access-Control-Allow-OriginNames which origins may read this response — the heart of CORS.Access-Control-Allow-MethodsLists the methods allowed for cross-origin requests.Access-Control-Allow-HeadersLists the headers allowed on cross-origin requests.Access-Control-Allow-CredentialsDecides whether cross-origin requests may carry cookies.Access-Control-Max-AgeSays how long the preflight result may be cached.AgeHow long the response has been sitting in a cache.AllowLists the methods the address accepts; it accompanies a 405.Content-DispositionDecides whether to display inline or download, and carries the file name.Content-Security-PolicyControls where scripts and images may come from — the fence that blunts XSS.ETagA fingerprint of this version; change the content and the tag changes, so caches notice.ExpiresMarks the moment after which the response is considered stale.Last-ModifiedWhen the resource last changed; conditional requests compare against it.LocationThe address to go to next; it accompanies redirects and a 201.Permissions-PolicyControls which documents may use features such as camera, microphone and location.Referrer-PolicyDecides how much referrer information is passed along.Retry-AfterSays when to try again; it accompanies a 429 or a 503.ServerNames the server software; too much detail hands attackers a hint.Set-CookiePlants a cookie in the browser; add HttpOnly and Secure to keep it safe.Strict-Transport-SecurityTells the browser to reach this site over https from now on.Timing-Allow-OriginAllows another origin to read detailed timing measurements.VaryNames the headers that change the response; caches key on it.WWW-AuthenticateStates which authentication scheme to use; it accompanies a 401.X-Content-Type-OptionsStops the browser guessing a different content type than declared.X-Frame-OptionsStops other sites embedding this page in a frame.X-XSS-ProtectionSwitched on an old browser XSS filter; CSP replaces it today.Cross-Origin-Opener-PolicyIsolates the browsing context so other origins cannot hold a handle to the window.Cross-Origin-Resource-PolicySays which origins may fetch this resource at all.Cross-Origin-Embedder-PolicyRequires embedded cross-origin resources to opt in explicitly.Content-RangeStates which slice of the whole was sent; it accompanies a 206.Accept-RangesSays whether range requests are supported; bytes means resuming works.Accept-PatchLists the patch document formats the resource accepts.Accept-PostLists the media types the resource accepts in a POST.Alt-SvcAdvertises another route to the same service, often used to point at HTTP/3.Clear-Site-DataTells the browser to wipe stored data; typically used at sign-out.LinkPoints at related resources from the header, also used to hint preloads.NELSets where the browser should report network errors it ran into.Report-ToRegisters named endpoints that later reports are sent to.Server-TimingReports how long each stage inside the server took.SourceMapPoints at the map that leads back to the original, unbundled source.X-DNS-Prefetch-ControlTurns the browser's DNS prefetching on or off.X-Permitted-Cross-Domain-PoliciesControls whether legacy plug-ins may load data from this origin.X-Robots-TagPasses indexing rules to search robots in a header, so it also works on images and PDFs.Origin-Agent-ClusterAsks the browser to keep this origin in its own isolated agent cluster.Proxy-AuthenticateStates how a proxy wants the client to prove who it is.Access-Control-Expose-HeadersLists which response headers a script is allowed to read.CDN-Cache-ControlA caching rule aimed only at the delivery network; browsers ignore it.Accept-CHLists the client hints the server wants; the browser sends them from the next request on.Critical-CHMarks hints as critical, so the browser retries the very first request with them attached.Reporting-EndpointsNames where error reports should be sent; it replaces the older Report-To.X-Powered-ByReveals the server technology; there is nothing to gain from it, so it is usually removed.X-CacheSays whether a CDN answered from cache; HIT means the origin was never reached.RefreshTells the browser to move elsewhere after a few seconds; not standard, but universally obeyed.Sec-WebSocket-AcceptReturns the client key hashed in a fixed way; the handshake only completes if it matches.Speculation-RulesGives the browser rules for which URLs to prefetch or prerender ahead of time.No-Vary-SearchSays which query parameters can be ignored when matching a cached response.X-UA-CompatibleTold old Internet Explorer which rendering mode to use.
Both directions22
Headers that can appear on either side.
Cache-ControlSets how long and where the response may be cached — half of web performance lives here.ConnectionSays whether to keep the connection open; HTTP/2 no longer uses it.Content-EncodingNames the compression applied to the body.Content-LanguageStates the language the body is written in.Content-LengthStates the size of the body in bytes.Content-TypeDeclares the media type and charset; get it wrong and an image shows up as text.DateThe moment the message was generated.PragmaAn old caching header; Cache-Control replaces it today.TrailerAnnounces which headers will follow after the body.Transfer-EncodingDescribes how the body is chunked for transfer; chunked means the length need not be known upfront.UpgradeProposes switching to another protocol; it pairs with a 101.ViaRecords the proxies the message passed through.WarningCarried caveats about caching or transformation; it is no longer used.PrioritySignals how urgent this request is and whether it may be delivered out of order.Content-LocationSays where the body that was just sent actually lives.Keep-AliveStates how long a reused connection should stay open.Content-DigestCarries a checksum of the body so the other side can tell if it arrived intact.TracestateCarries vendor-specific trace data alongside traceparent.Repr-DigestCarries a hash of the representation so the other side can check it arrived intact.SignatureThe signature over the message, so the receiver can verify who sent it.Signature-InputSays what the signature covers: which headers were signed and how.X-Request-IDA per-request id used to find that one request again in the logs.
How to read this
- The first digit of a status code carries the meaning: 4 means the request, 5 means the server.
- 404 means "not there"; 403 means "there, but not for you". Swapping them makes debugging slower.
- Header names are case-insensitive — Content-Type and content-type are the same header.
- Caching and CORS problems usually come down to one header line, visible in the browser’s network tab.
Frequently asked questions
QWhat is the difference between 404 and 403?
404 says nothing is at that address; 403 says something is, but you may not see it. Some servers deliberately answer 404 to hide the fact that a resource exists at all.
QCan I do anything about a 500?
Codes starting with 5 are the server’s problem, so usually only waiting helps. A 502 or 504 sits between a front and back server, though, and often clears on a retry a moment later.
QHow do I choose between 301 and 302?
Use 301 when the address has moved for good and 302 when it is temporary. Remember that browsers and search engines remember a 301 for a long time, which makes it hard to undo.
QAre header names case-sensitive?
No. Content-Type and content-type are the same header, and since HTTP/2 they are sent lowercase by definition.
QWhy do CORS errors happen?
When a page tries to read a response from another origin, the browser blocks it unless the server allowed it with Access-Control-Allow-Origin. The server did answer — the browser simply refuses to hand the body to your code, which is why the network tab shows a response your script cannot read.