132 HTTP status codes and headers
What 404 and 500 actually mean, and what Content-Type or Cache-Control do — one line each.
Status codes
1xx Informational4
A progress note; the real answer follows.
100 ContinueThe first part of the request arrived; go ahead and send the rest.101 Switching ProtocolsThe connection is switching protocol — this is how a WebSocket begins.102 ProcessingStill working — please wait. Used for operations that take a long time.103 Early HintsSends hints ahead of the body so the browser can start fetching resources early.
2xx Success10
The request went through.
200 OKThe request succeeded — the most common response of all.201 CreatedA new resource was created; the Location header carries its address.202 AcceptedThe request was accepted but has not been carried out yet.203 Non-Authoritative InformationThe answer was modified by a proxy rather than coming straight from the origin.204 No ContentSuccess, but there is nothing to send back — handy after a save when the page should not change.205 Reset ContentSuccess — and the client should clear the form it sent.206 Partial ContentOnly the requested slice was sent — this is what makes resumable downloads and video seeking work.207 Multi-StatusCarries the results for several resources in one response.208 Already ReportedAlready reported earlier in the response, so it is not repeated.226 IM UsedOnly the differences from the requested resource were sent.
3xx Redirection7
Go somewhere else — the distinction is permanent versus temporary.
300 Multiple ChoicesThere is more than one possible resource to choose from.301 Moved PermanentlyThe address moved for good; search ranking follows to the new URL.302 FoundGo elsewhere for now; the original address stays valid.303 See OtherFetch the result from another URL with GET — the usual answer after a form submission.304 Not ModifiedWhat you have is still current — reuse it. No body is sent, which is what makes caching fast.307 Temporary RedirectA temporary move that keeps the original method — a POST stays a POST.308 Permanent RedirectA permanent move that keeps the original method.
4xx Client error29
The problem is on the request side; sending the same thing again will fail again.
400 Bad RequestThe request itself is malformed and cannot be read.401 UnauthorizedYou have not said who you are; signing in usually resolves it.402 Payment RequiredPayment is required — reserved in the standard but rarely used in practice.403 ForbiddenThe server knows who you are and still says no; signing in may not change it.404 Not FoundNothing lives at that address — the URL is wrong or the page is gone.405 Method Not AllowedThe address exists but does not accept that method.406 Not AcceptableThe server cannot produce the format you asked for.407 Proxy Authentication RequiredA proxy in between wants authentication first.408 Request TimeoutThe server waited and the request never finished arriving.409 ConflictThe request clashes with the current state — typical of two edits at once.410 GoneDeliberately removed and not coming back — a clearer goodbye than 404.411 Length RequiredThe request must state its body length and did not.412 Precondition FailedA condition attached to the request did not hold.413 Content Too LargeThe body you sent is larger than the server accepts.414 URI Too LongThe URL is too long — usually the result of piling on query parameters.415 Unsupported Media TypeThe server cannot handle the media type you sent.416 Range Not SatisfiableThe requested byte range lies outside the file.417 Expectation FailedThe expectation given in the Expect header cannot be met.418 I'm a teapotA joke code: the teapot refuses to brew coffee. It began as an April Fools RFC.421 Misdirected RequestThis server is not the right one to answer that request.422 Unprocessable ContentThe syntax is fine but the content breaks the rules, so it cannot be processed.423 LockedThe resource is locked.424 Failed DependencyAn earlier request failed, so this one cannot go ahead either.425 Too EarlyThe server will not risk processing a request that might be a replay.426 Upgrade RequiredYou must switch to a different protocol to continue.428 Precondition RequiredThe request must carry a condition — this is how lost updates are prevented.429 Too Many RequestsYou sent too many requests; Retry-After says when to try again.431 Request Header Fields Too LargeThe headers are too large — often the result of accumulated cookies.451 Unavailable For Legal ReasonsBlocked for legal reasons; the number nods to the novel Fahrenheit 451.
5xx Server error11
The problem is on the server side; retrying later is often worth it.
500 Internal Server ErrorSomething broke inside the server; the request itself was fine.501 Not ImplementedThe server does not implement that capability yet.502 Bad GatewayA gateway got a bad answer from the server behind it.503 Service UnavailableThe server cannot take requests right now — maintenance or overload.504 Gateway TimeoutA gateway waited for the server behind it and ran out of time.505 HTTP Version Not SupportedThat HTTP version is not supported.506 Variant Also NegotiatesA server configuration error makes content negotiation loop on itself.507 Insufficient StorageThere is not enough storage left to finish.508 Loop DetectedThe server detected an infinite loop while processing.510 Not ExtendedThe request needs a further extension to be fulfilled.511 Network Authentication RequiredYou must sign in to the network first — the usual sight on public Wi-Fi.
Headers
Request headers28
Headers the browser attaches when it sends to the server.
AcceptTells the server which formats the client can accept.Accept-EncodingLists the compressions the client understands; gzip or br cut transfer size a lot.Accept-LanguageStates the preferred languages; multilingual sites pick a version from it.AuthorizationCarries the credentials that prove who you are — a token or a username and password.CookieSends back the cookies the server set earlier.HostNames the domain being addressed — what lets one server host many sites.If-Modified-SinceAsks for the resource only if it changed after that time.If-None-MatchAsks for the resource only if its ETag differs — this is how a cache revalidates.OriginStates where the request came from; the browser adds it and CORS decisions rest on it.RangeRequests only part of a file — the basis of resumable downloads and video seeking.RefererNames the page you came from; the misspelling was baked into the standard long ago.User-AgentDescribes the browser and device; these strings are mostly camouflage nowadays.Sec-Fetch-DestSays what the request is for — an image, a script, a document.Sec-Fetch-ModeStates whether the request is same-origin, CORS or a navigation.Sec-Fetch-SiteSays whether the request came from the same site or a different one.DNTAsks not to be tracked; it carries no force and is largely ignored.ExpectChecks with the server before sending a large body.ForwardedRecords the original client details of a request that passed through proxies.FromCarries an email address for whoever sent the request; crawlers use it as contact.If-MatchProceed only if the ETag matches — this prevents overwriting someone else’s change.If-RangeResume the download if the file is unchanged; otherwise start over.Max-ForwardsLimits how many proxies a request may pass through.Proxy-AuthorizationCredentials presented to a proxy rather than the origin server.TELists the transfer encodings the client will accept.Upgrade-Insecure-RequestsAsks the server to upgrade any plain http links to https.X-Forwarded-ForCarries the original client IP through proxies; not standard but used everywhere.X-Forwarded-ProtoSays whether the original request arrived over http or https.X-Requested-WithAn old convention marking a request as coming from JavaScript.
Response headers30
Headers the server attaches when it answers.
Access-Control-Allow-OriginNames which origins may read this response — the heart of CORS.Access-Control-Allow-MethodsLists the methods allowed for cross-origin requests.Access-Control-Allow-HeadersLists the headers allowed on cross-origin requests.Access-Control-Allow-CredentialsDecides whether cross-origin requests may carry cookies.Access-Control-Max-AgeSays how long the preflight result may be cached.AgeHow long the response has been sitting in a cache.AllowLists the methods the address accepts; it accompanies a 405.Content-DispositionDecides whether to display inline or download, and carries the file name.Content-Security-PolicyControls where scripts and images may come from — the fence that blunts XSS.ETagA fingerprint of this version; change the content and the tag changes, so caches notice.ExpiresMarks the moment after which the response is considered stale.Last-ModifiedWhen the resource last changed; conditional requests compare against it.LocationThe address to go to next; it accompanies redirects and a 201.Permissions-PolicyControls which documents may use features such as camera, microphone and location.Referrer-PolicyDecides how much referrer information is passed along.Retry-AfterSays when to try again; it accompanies a 429 or a 503.ServerNames the server software; too much detail hands attackers a hint.Set-CookiePlants a cookie in the browser; add HttpOnly and Secure to keep it safe.Strict-Transport-SecurityTells the browser to reach this site over https from now on.Timing-Allow-OriginAllows another origin to read detailed timing measurements.VaryNames the headers that change the response; caches key on it.WWW-AuthenticateStates which authentication scheme to use; it accompanies a 401.X-Content-Type-OptionsStops the browser guessing a different content type than declared.X-Frame-OptionsStops other sites embedding this page in a frame.X-XSS-ProtectionSwitched on an old browser XSS filter; CSP replaces it today.Cross-Origin-Opener-PolicyIsolates the browsing context so other origins cannot hold a handle to the window.Cross-Origin-Resource-PolicySays which origins may fetch this resource at all.Cross-Origin-Embedder-PolicyRequires embedded cross-origin resources to opt in explicitly.Content-RangeStates which slice of the whole was sent; it accompanies a 206.Accept-RangesSays whether range requests are supported; bytes means resuming works.
Both directions13
Headers that can appear on either side.
Cache-ControlSets how long and where the response may be cached — half of web performance lives here.ConnectionSays whether to keep the connection open; HTTP/2 no longer uses it.Content-EncodingNames the compression applied to the body.Content-LanguageStates the language the body is written in.Content-LengthStates the size of the body in bytes.Content-TypeDeclares the media type and charset; get it wrong and an image shows up as text.DateThe moment the message was generated.PragmaAn old caching header; Cache-Control replaces it today.TrailerAnnounces which headers will follow after the body.Transfer-EncodingDescribes how the body is chunked for transfer; chunked means the length need not be known upfront.UpgradeProposes switching to another protocol; it pairs with a 101.ViaRecords the proxies the message passed through.WarningCarried caveats about caching or transformation; it is no longer used.
How to read this
- The first digit of a status code carries the meaning: 4 means the request, 5 means the server.
- 404 means "not there"; 403 means "there, but not for you". Swapping them makes debugging slower.
- Header names are case-insensitive — Content-Type and content-type are the same header.
- Caching and CORS problems usually come down to one header line, visible in the browser’s network tab.
Frequently asked questions
Q. What is the difference between 404 and 403?
404 says nothing is at that address; 403 says something is, but you may not see it. Some servers deliberately answer 404 to hide the fact that a resource exists at all.
Q. Can I do anything about a 500?
Codes starting with 5 are the server’s problem, so usually only waiting helps. A 502 or 504 sits between a front and back server, though, and often clears on a retry a moment later.
Q. How do I choose between 301 and 302?
Use 301 when the address has moved for good and 302 when it is temporary. Remember that browsers and search engines remember a 301 for a long time, which makes it hard to undo.
Q. Are header names case-sensitive?
No. Content-Type and content-type are the same header, and since HTTP/2 they are sent lowercase by definition.
Q. Why do CORS errors happen?
When a page tries to read a response from another origin, the browser blocks it unless the server allowed it with Access-Control-Allow-Origin. The server did answer — the browser simply refuses to hand the body to your code, which is why the network tab shows a response your script cannot read.