HTTP Status Code Reference
Every HTTP status code, explained in the practical terms you need mid-debug: what it means, who is at fault, and what to check. Covers the full IANA registry plus the unofficial nginx and Cloudflare codes (499, 520–526) that fill real production logs.
New to this? Read the HTTP status codes guide →
Everything runs locally in your browser — the full reference is on this page and searchable offline. Descriptions follow the current IETF HTTP semantics (RFC 9110) plus the nginx and Cloudflare codes you actually meet in logs.
How to read a status code fast
The first digit tells you who to blame: 2xx worked, 3xx moved, 4xx means the request is wrong (fix the client), 5xx means the server failed (check the logs). Within 4xx, the pair everyone mixes up: 401 is "who are you?" (unauthenticated) and 403 is "I know who you are — no" (unauthorised). Within 5xx, 502/504 point at the hop behind your proxy, not the proxy itself.
Debugging tip: which codes matter in logs
Spikes of 499 mean users are giving up before your backend answers; 429 means your rate limits are biting; a burst of 502 after a deploy is your app failing to boot behind the load balancer. The guide covers picking the right code when you're the one writing the API.
Frequently asked questions
What do the status code classes mean?
The first digit assigns blame: 2xx success, 3xx the resource is elsewhere, 4xx the client’s request is at fault, 5xx the server failed, and 1xx interim information. Retriers, caches and monitors all key off this first digit.
What is the difference between 401 and 403?
401 means unauthenticated — the server doesn’t know who you are, and logging in can fix it. 403 means unauthorised — it knows exactly who you are and the answer is no; retrying with the same credentials will never help.
What is the difference between 502 and 504?
Both come from a proxy or load balancer. 502 means the app behind it returned garbage or refused the connection (is the process up?); 504 means it accepted but didn’t answer in time — and the work may still have completed, so retry non-idempotent requests carefully.
What is error 522 (or 520–526)?
Cloudflare’s unofficial codes describing failures between Cloudflare and your origin server: 521 connection refused, 522 TCP handshake timed out, 524 response took too long, 525/526 TLS problems. A user seeing 522 means Cloudflare couldn’t reach your server.
What is a 499 status code?
An nginx-specific code meaning the client closed the connection before the server responded. A spike of 499s is a latency symptom: users (or their timeouts) are giving up before your backend answers.