HTTP Status Codes — Complete List & Lookup

Sent in reply to a request with an Expect: 100-continue header, so a client can check the server will accept a large upload before sending it. Browsers rarely see it; it's common with API clients such as curl.

Defined in: RFC 9110 §15.2.1 · Link to 100

Most often seen when a WebSocket connection is opened: the HTTP/1.1 connection is upgraded and from then on carries the WebSocket protocol.

Defined in: RFC 9110 §15.2.2 · Link to 101

A WebDAV interim response that stopped clients timing out on long operations. It was removed from later WebDAV specs and is considered deprecated.

Defined in: RFC 2518 (WebDAV) · Link to 102

Sent before the final response while the server is still building the page. The browser can start preloading or preconnecting to CSS, fonts and scripts listed in Link headers, improving load time. Supported by Chrome, Edge, Firefox and CDNs such as Cloudflare.

SEO impact: Can improve Largest Contentful Paint (a Core Web Vital) by starting critical downloads sooner.

Defined in: RFC 8297 · Link to 103

The standard success response. For GET the body is the requested resource; for POST it typically describes the result of the action.

SEO impact: The only status search engines index as a normal page. Make sure error pages don't return 200 (a "soft 404").

Defined in: RFC 9110 §15.3.1 · Link to 200

Typical reply to a POST or PUT that creates something. The Location header should point to the new resource.

Defined in: RFC 9110 §15.3.2 · Link to 201

Used for asynchronous jobs (exports, video processing, queued emails). The response often includes a link where the client can check progress.

Defined in: RFC 9110 §15.3.3 · Link to 202

A transforming proxy changed the origin server's 200 response (for example, compressed images or altered headers) and is telling the client so.

Defined in: RFC 9110 §15.3.4 · Link to 203

Common for DELETE requests, saving settings via an API, and CORS preflight responses. The browser stays on the current page.

Defined in: RFC 9110 §15.3.5 · Link to 204

Tells the user agent to clear the document view, e.g. empty a form after submission so another entry can be made. Rarely used in practice.

Defined in: RFC 9110 §15.3.6 · Link to 205

Used for resumable downloads and media streaming: the client asks for a byte range and the server returns just that part with a Content-Range header.

Defined in: RFC 9110 §15.3.7 · Link to 206

A WebDAV response (an XML body) used when one request affects multiple resources and each may have a different result.

Defined in: RFC 4918 (WebDAV) · Link to 207

Used inside a 207 Multi-Status body to avoid listing the same resource repeatedly when it's reachable through multiple bindings.

Defined in: RFC 5842 (WebDAV) · Link to 208

Part of HTTP delta encoding: the server sends only the differences from a version the client already has. Very rarely used.

Defined in: RFC 3229 · Link to 226

For example different languages or formats. There's no standard way to pick automatically, so it's rarely used — most sites negotiate or redirect instead.

Defined in: RFC 9110 §15.4.1 · Link to 300

Browsers cache 301s aggressively and go straight to the new URL next time. Clients may change a POST into a GET when following it; use 308 if the method must be kept.

SEO impact: The standard redirect for permanent moves (http→https, domain changes, new slugs). Search engines replace the old URL with the new one in their index and pass ranking signals. Point it at the final URL to avoid chains.

Defined in: RFC 9110 §15.4.2 · Link to 301

The client should keep using the original URL for future requests. Historically browsers change POST to GET when following a 302; 307 is the method-preserving equivalent.

SEO impact: Signals a temporary move, so Google usually keeps the original URL indexed. If the move is permanent, use 301 instead. Google may treat a long-standing 302 as permanent eventually, but don't rely on it.

Defined in: RFC 9110 §15.4.3 · Link to 302

Used after a form POST to send the browser to a confirmation page with GET (the Post/Redirect/Get pattern), which prevents duplicate submissions on refresh.

SEO impact: Treated as a temporary redirect.

Defined in: RFC 9110 §15.4.4 · Link to 303

Reply to a conditional request (If-None-Match with an ETag, or If-Modified-Since). The client uses its cached version, saving bandwidth.

SEO impact: Good for crawl efficiency: Googlebot supports conditional requests and spends less crawl budget on unchanged pages.

Defined in: RFC 9110 §15.4.5 · Link to 304

Deprecated for security reasons (it could make a client use an attacker-chosen proxy). Browsers ignore it.

Defined in: RFC 9110 §15.4.6 · Link to 305

Was once "Switch Proxy" in a draft spec. The code is reserved and must not be used.

Defined in: RFC 9110 §15.4.7 · Link to 306

Like 302, but the client must not change the method — a POST stays a POST. Browsers also show an internal 307 when HSTS forces http to https (no request is actually sent).

SEO impact: Temporary: search engines keep the original URL indexed.

Defined in: RFC 9110 §15.4.8 · Link to 307

The method-preserving version of 301. Supported by all modern browsers.

SEO impact: Treated the same as 301 by Google: the new URL replaces the old one and signals are consolidated.

Defined in: RFC 9110 §15.4.9 (originally RFC 7538) · Link to 308

Covers anything the server considers a client error that has no more specific code: invalid syntax, bad JSON, invalid query parameters, oversized or corrupt cookies.

Common causes

• Malformed URL or query string
• Invalid JSON or form data sent to an API
• Corrupt or oversized cookies
• Missing required parameters

How to fix it

• Visitors: clear cookies for the site and retry; check the URL for typos
• Developers: read the response body — APIs usually explain what's wrong; validate input before sending

Defined in: RFC 9110 §15.5.1 · Link to 400

Despite the name it means unauthenticated. The response must include a WWW-Authenticate header describing how to log in (Basic, Bearer…).

Common causes

• Not logged in or session expired
• Missing, expired or wrong API key / bearer token
• Wrong username or password for HTTP Basic auth

How to fix it

• Log in again or refresh the access token
• Check the Authorization header is sent and correctly formatted
• Use 403, not 401, when the user is logged in but not allowed

SEO impact: Pages behind 401 can't be crawled or indexed. Fine for private areas — keep public content public.

Defined in: RFC 9110 §15.5.2 · Link to 401

There's no standard meaning. Some services (for example Stripe and some SaaS APIs) return it when a payment failed or a plan limit or subscription has lapsed.

Common causes

• Payment declined or subscription expired on a paid API
• Quota of a paid plan exhausted

How to fix it

• Check billing details and plan limits with the service provider

Defined in: RFC 9110 §15.5.3 · Link to 402

Authentication won't help (or you're already authenticated): you simply don't have permission. Web application firewalls and bot protection also answer with 403.

Common causes

• File or folder permissions on the server (e.g. not readable by the web server)
• No index file and directory listing disabled
• IP, country or user-agent block by a firewall/WAF or CDN
• Logged-in user lacks the required role
• .htaccess deny rules or hotlink protection

How to fix it

• Server owners: check file permissions (typically 644 for files, 755 for folders) and ownership
• Make sure an index.html/index.php exists
• Review WAF/CDN firewall events for blocked requests
• Visitors: disable VPN, clear cookies, or contact the site owner

SEO impact: Googlebot treats 403 like 404 for indexing: the page is dropped. Check that your firewall isn't blocking real search engine crawlers.

Defined in: RFC 9110 §15.5.4 · Link to 403

The most famous error. It doesn't say whether the absence is temporary or permanent. Servers also use it to hide resources a client isn't allowed to know about.

Common causes

• Typo in the URL or a broken link
• Page deleted or moved without a redirect
• Wrong rewrite/routing rules (e.g. missing .htaccess or permalink settings)
• Case-sensitive paths on Linux servers

How to fix it

• Add a 301 redirect from the old URL to the most relevant new page
• Fix internal links pointing to the URL
• Give the 404 page helpful navigation and search
• Make sure the 404 page really returns status 404, not 200

SEO impact: 404s for pages that never existed don't hurt rankings. Pages that return 404 are dropped from the index after recrawling; redirect removed pages that have backlinks or traffic. Returning 200 on an error page creates a "soft 404".

Defined in: RFC 9110 §15.5.5 · Link to 404

For example a POST to a URL that only accepts GET. The response must include an Allow header listing the supported methods.

Common causes

• Form or API call using the wrong method
• Server or framework route only defined for another method
• WebDAV or a security module blocking PUT/DELETE

How to fix it

• Check the Allow header and use one of the listed methods
• Add a route/handler for the method on the server

Defined in: RFC 9110 §15.5.6 · Link to 405

Content negotiation failed: the client asked (via Accept, Accept-Language, etc.) for a format or language the server can't provide. Some security modules (e.g. mod_security) also misuse 406 to block requests.

Common causes

• Overly strict Accept header on an API request
• mod_security rules blocking the request

How to fix it

• Send a broader Accept header (e.g. */*)
• Check server security-module logs

Defined in: RFC 9110 §15.5.7 · Link to 406

Like 401, but for a proxy between the client and the server. The proxy sends a Proxy-Authenticate header.

Common causes

• Corporate proxy requires login
• Wrong proxy credentials configured

How to fix it

• Configure proxy credentials in your system, browser or HTTP client

Defined in: RFC 9110 §15.5.8 · Link to 407

The client opened a connection but didn't send a complete request in time. Servers may also send it to close idle keep-alive connections.

Common causes

• Slow or unstable client connection
• Large uploads on a slow link
• Server request timeout set too low

How to fix it

• Retry the request
• Increase the server's client body/header timeout if uploads legitimately take long

Defined in: RFC 9110 §15.5.9 · Link to 408

Typical in APIs: creating something that already exists, or editing a record someone else changed in the meantime.

Common causes

• Duplicate unique value (username, email, ID)
• Concurrent edit / version mismatch

How to fix it

• Fetch the latest version, resolve the conflict and retry
• Use a different unique value

Defined in: RFC 9110 §15.5.10 · Link to 409

A stronger statement than 404: the server knows the content existed and won't come back, so clients should delete links to it.

Common causes

• Content intentionally deleted (expired listings, discontinued products)

How to fix it

• If there's a relevant replacement, use a 301 to it instead
• Otherwise keep the 410 and remove internal links

SEO impact: Google treats 410 almost like 404 but may drop the URL from the index slightly faster. Use it for content that's gone for good.

Defined in: RFC 9110 §15.5.11 · Link to 410

The request had a body but no Content-Length, and the server won't accept chunked transfer for it.

Common causes

• Client sends a POST/PUT body without Content-Length
• Empty POST with no Content-Length: 0

How to fix it

• Send Content-Length (Content-Length: 0 for an empty body)

Defined in: RFC 9110 §15.5.12 · Link to 411

Used for optimistic concurrency: the client says "only update if the ETag is still X" and the resource has changed since.

Common causes

• Resource changed since the client fetched it
• Stale ETag in If-Match / If-Unmodified-Since

How to fix it

• Re-fetch the resource to get the current ETag, re-apply the change and retry

Defined in: RFC 9110 §15.5.13 · Link to 412

Previously called "Payload Too Large" (and before that "Request Entity Too Large"). Common when uploading files.

Common causes

• Upload exceeds nginx client_max_body_size (default 1 MB)
• PHP upload_max_filesize / post_max_size too small
• CDN or proxy body-size limits

How to fix it

• Upload a smaller file or compress it
• Server owners: raise client_max_body_size, LimitRequestBody or the PHP limits

Defined in: RFC 9110 §15.5.14 · Link to 413

Usually caused by sending large amounts of data in the query string or by a redirect loop that keeps appending parameters.

Common causes

• Huge query string (e.g. a GET form with lots of data)
• Redirect loop appending parameters

How to fix it

• Send large data in a POST body instead
• Fix redirect rules that keep growing the URL

Defined in: RFC 9110 §15.5.15 · Link to 414

The Content-Type (or Content-Encoding) of the request isn't supported by this endpoint.

Common causes

• Sending JSON without Content-Type: application/json
• Uploading a file type the endpoint doesn't accept

How to fix it

• Set the correct Content-Type header
• Convert the data to a format the API expects

Defined in: RFC 9110 §15.5.16 · Link to 415

The Range header asked for bytes that don't exist — usually because the file changed or got smaller since a download started.

Common causes

• Resuming a download of a file that has changed
• Buggy download manager or media player

How to fix it

• Restart the download from the beginning
• Clear the browser or app cache

Defined in: RFC 9110 §15.5.17 · Link to 416

Usually the server or a proxy doesn't support Expect: 100-continue.

Common causes

• Client sends Expect: 100-continue to a server or proxy that rejects it

How to fix it

• Remove the Expect header from the request (e.g. curl -H 'Expect:')

Defined in: RFC 9110 §15.5.18 · Link to 417

From an April Fools' RFC about coffee pots. It isn't a real HTTP status, but it's so widely implemented that RFC 9110 reserves 418 so nobody reuses it. Some sites return it to bots they want to turn away.

Common causes

• An Easter egg in a framework or API
• A site deliberately refusing automated requests

How to fix it

• Nothing to fix — if you see it on a real site, you're probably being blocked as a bot

Defined in: RFC 2324 (HTCPCP, April Fools' joke); reserved as (Unused) in RFC 9110 §15.5.19 · Link to 418

Happens with HTTP/2 or HTTP/3 connection reuse: the browser reused a connection for a different hostname covered by the same certificate, but that server isn't configured for it.

Common causes

• Shared certificate across hosts on different servers
• Inconsistent TLS/SNI configuration between virtual hosts

How to fix it

• Make every host on the certificate servable from each server, or use separate certificates
• Align TLS settings across virtual hosts

Defined in: RFC 9110 §15.5.20 · Link to 421

Formerly "Unprocessable Entity". The syntax is correct but the content fails validation — popular with REST APIs and frameworks like Rails and Laravel for form validation errors.

Common causes

• Validation errors: missing required fields, invalid email, value out of range

How to fix it

• Read the error details in the response body and correct the submitted data

Defined in: RFC 9110 §15.5.21 (originally RFC 4918) · Link to 422

A WebDAV code meaning someone else holds a lock on the file or folder.

Common causes

• File opened for editing by another user or process

How to fix it

• Wait for the lock to be released or ask the lock owner to close the file

Defined in: RFC 4918 (WebDAV) · Link to 423

A WebDAV code used inside multi-step operations: one part failed, so the dependent part couldn't run.

Common causes

• An earlier operation in the same request failed

How to fix it

• Fix the first failing operation, then retry

Defined in: RFC 4918 (WebDAV) · Link to 424

Related to TLS 1.3 early data (0-RTT): requests sent before the handshake completes can be replayed by an attacker, so the server asks the client to retry after the handshake.

Common causes

• Non-idempotent request sent as TLS 1.3 early data

How to fix it

• Clients retry automatically after the handshake; servers can disable 0-RTT for sensitive endpoints

Defined in: RFC 8470 · Link to 425

The server refuses the request with the current protocol and names the required one in an Upgrade header — for example requiring TLS or a newer HTTP version.

Common causes

• Endpoint requires a newer protocol (e.g. HTTP/2, WebSocket or TLS)

How to fix it

• Update the client to use the protocol named in the Upgrade header

Defined in: RFC 9110 §15.5.22 · Link to 426

Protects against lost updates: the server insists on an If-Match header so clients can't overwrite changes they haven't seen.

Common causes

• Update sent without If-Match / ETag

How to fix it

• Fetch the resource, then send the update with If-Match set to its ETag

Defined in: RFC 6585 · Link to 428

The server may include a Retry-After header saying how long to wait.

Common causes

• API rate limit or quota exceeded
• Aggressive scraping or bots
• Brute-force protection on login forms
• Shared IP (VPN, office, CGNAT) used by many people

How to fix it

• Wait for the time in Retry-After and slow down
• Add exponential backoff and caching in your client
• Request a higher limit or use an authenticated plan

SEO impact: If Googlebot gets 429s it slows its crawling. Persistent 429s on important pages can lead to them dropping from the index — don't rate-limit verified search engine crawlers too tightly.

Defined in: RFC 6585 · Link to 429

Either one header or all headers together exceed the server's limit — almost always because of too many or too-large cookies.

Common causes

• Huge or numerous cookies for the domain
• Very long Referer or Authorization header

How to fix it

• Clear the site's cookies
• Developers: store less in cookies, or raise the server's header buffer limit

Defined in: RFC 6585 · Link to 431

Used when content is blocked due to a court order, government censorship or regional law (for example GDPR geo-blocking). The number is a nod to the novel Fahrenheit 451.

Common causes

• Court order or takedown
• Content blocked in your country

How to fix it

• Nothing to fix technically; the response may link to the legal demand

SEO impact: Treated as not available — the page won't be indexed in affected regions.

Defined in: RFC 7725 · Link to 451

A catch-all for unhandled errors in the application or server configuration. The real cause is in the server's error logs.

Common causes

• Bug or uncaught exception in application code
• Syntax error in .htaccess or server config
• Wrong file permissions on scripts
• PHP memory limit or fatal error
• Failed database query or connection

How to fix it

• Check the web server and application error logs
• Undo the most recent deploy, plugin install or config change
• On WordPress: disable plugins and switch to a default theme to find the culprit
• Increase memory/time limits if the logs show they were hit

SEO impact: Occasional 500s are tolerated, but if they persist Googlebot slows crawling and eventually drops the affected URLs.

Defined in: RFC 9110 §15.6.1 · Link to 500

Usually the server doesn't recognise the HTTP method at all (unlike 405, where the method is known but not allowed on this URL).

Common causes

• Uncommon or custom HTTP method
• Feature not built yet on an API

How to fix it

• Use a standard method the server supports
• Check the API documentation

Defined in: RFC 9110 §15.6.2 · Link to 501

Something between you and the application — a load balancer, reverse proxy (nginx) or CDN — tried to reach the backend and got nonsense or a closed connection.

Common causes

• Application server (PHP-FPM, Node, Gunicorn) crashed or isn't running
• Backend overloaded and dropping connections
• Wrong upstream address or port in the proxy config
• Firewall blocking the proxy from the backend

How to fix it

• Restart the application server and check its logs
• Verify the proxy's upstream host/port
• Check resource limits (memory, worker count)
• Visitors: wait a minute and reload

SEO impact: Treated like other 5xx: short outages are fine; persistent errors reduce crawling and can drop pages.

Defined in: RFC 9110 §15.6.3 · Link to 502

Overload or planned maintenance. The server can send a Retry-After header to say when to try again.

Common causes

• Maintenance mode
• Server overloaded or out of workers
• Application pool stopped (IIS)
• Upstream dependency down

How to fix it

• Check whether maintenance mode is still on
• Scale up or add caching for traffic spikes
• Send Retry-After during planned downtime

SEO impact: The right status for planned maintenance: return 503 with a Retry-After header and Google will come back later without dropping pages. Don't serve a maintenance page with 200, and don't keep 503 for more than a day or two.

Defined in: RFC 9110 §15.6.4 · Link to 503

The backend is reachable but too slow: the load balancer, reverse proxy or CDN gave up waiting.

Common causes

• Slow database queries or external API calls
• Long-running scripts (imports, reports) on a web request
• Proxy timeout set lower than the app needs
• Backend overloaded

How to fix it

• Optimise slow queries and add caching
• Move long jobs to a background queue
• Raise proxy timeouts (e.g. nginx proxy_read_timeout) if appropriate

Defined in: RFC 9110 §15.6.5 · Link to 504

Rare today. Usually indicates a malformed request line or a very old or misconfigured server.

Common causes

• Malformed request line
• Client forcing an HTTP version the server doesn't support

How to fix it

• Use HTTP/1.1 or let the client negotiate the version

Defined in: RFC 9110 §15.6.6 · Link to 505

Transparent content negotiation led to a circular reference: the chosen variant is itself configured to negotiate.

Common causes

• Misconfigured content negotiation (e.g. Apache type maps)

How to fix it

• Fix the server's negotiation/variant configuration

Defined in: RFC 2295 · Link to 506

A WebDAV code, also used by some hosting control panels, when the disk or quota is full.

Common causes

• Disk full or storage quota exceeded

How to fix it

• Free up disk space or increase the quota

Defined in: RFC 4918 (WebDAV) · Link to 507

A WebDAV code for loops in bindings with Depth: infinity. Some hosts (e.g. LiteSpeed/CloudLinux) misuse 508 for "resource limit reached".

Common causes

• Circular WebDAV bindings
• On shared hosting: CPU/process limits hit (non-standard use)

How to fix it

• Fix the binding loop
• On shared hosting: reduce load or upgrade the plan

Defined in: RFC 5842 (WebDAV) · Link to 508

From the HTTP Extension Framework, which was never widely adopted; the RFC now has Historic status.

Common causes

• Request is missing a mandatory extension declaration

How to fix it

• Add the extension the server requires (rarely seen in practice)

Defined in: RFC 2774 (Historic) · Link to 510

Sent by captive portals (hotel, airport and café Wi-Fi) that intercept traffic until you accept terms or log in.

Common causes

• Captive portal on public Wi-Fi

How to fix it

• Open any http:// page in the browser to bring up the Wi-Fi login page and sign in

Defined in: RFC 6585 · Link to 511

Laravel returns 419 when a form is submitted with an invalid or expired CSRF token, usually because the session timed out.

Common causes

• Form left open longer than the session lifetime
• Missing @csrf in the form
• Session/cookie domain misconfiguration

How to fix it

• Reload the page and submit again
• Developers: include @csrf and check SESSION_DOMAIN and cookie settings

Defined in: Laravel framework · Link to 419

Twitter's original Search and Trends API returned 420 when clients were rate-limited. It now uses the standard 429. Spring Framework once used 420 for "Method Failure" (deprecated).

Common causes

• Rate-limited by a legacy API

How to fix it

• Slow down requests; modern APIs use 429 instead

Defined in: Twitter API v1 (historic); Spring Framework used 420 for "Method Failure" · Link to 420

Used by Microsoft IIS and Exchange (Outlook Web Access) when a session times out.

Common causes

• Session expired

How to fix it

• Log in again

Defined in: Microsoft IIS · Link to 440

Used only inside nginx config (return 444;) to drop unwanted requests such as bots or requests to an unknown host. The client never actually receives a 444 — it sees an empty reply or connection reset, and 444 appears in the server's access log.

Common causes

• nginx rule deliberately dropping the request (blocked bot, invalid Host header)

How to fix it

• Server owners: review the nginx rule returning 444; visitors can't fix it

Defined in: nginx · Link to 444

nginx's internal code before it sends a 400 Bad Request — "Request Header Or Cookie Too Large".

Common causes

• Oversized cookies
• large_client_header_buffers too small

How to fix it

• Clear cookies
• Raise large_client_header_buffers in nginx

Defined in: nginx · Link to 494

Logged when mutual TLS (client certificate authentication) is enabled and the client sent a certificate that failed verification.

Common causes

• Client certificate expired, revoked or signed by an untrusted CA

How to fix it

• Install a valid client certificate

Defined in: nginx · Link to 495

Used with mutual TLS when ssl_verify_client is on and the client didn't present a certificate.

Common causes

• Client certificate missing

How to fix it

• Configure the client to send its certificate

Defined in: nginx · Link to 496

Happens when someone requests http://example.com:443. Often handled with error_page 497 to redirect to https.

Common causes

• URL uses http:// with the HTTPS port

How to fix it

• Use https://
• Server owners: add error_page 497 =301 https://$host$request_uri;

Defined in: nginx · Link to 497

Returned by Esri's ArcGIS Server when a token is invalid or has expired.

Common causes

• Expired or malformed ArcGIS token

How to fix it

• Generate a new token

Defined in: Esri ArcGIS Server · Link to 498

Appears in nginx logs when the visitor (or an upstream load balancer) gave up waiting — often a symptom of slow backend responses.

Common causes

• User navigated away or pressed stop
• Client or load balancer timeout shorter than the backend's response time

How to fix it

• Speed up slow endpoints
• Align load balancer and client timeouts with backend response times

Defined in: nginx · Link to 499

Returned by shared hosting (cPanel, Apache bandwidth modules) when the site exceeds its monthly or per-period transfer limit.

Common causes

• Traffic spike or hotlinked large files on a capped hosting plan

How to fix it

• Upgrade the hosting plan or wait for the limit to reset
• Use a CDN and block hotlinking

Defined in: Apache / cPanel hosting · Link to 509

Cloudflare connected to your server but got something it couldn't use — e.g. an empty reply, a crash mid-response or oversized headers.

Common causes

• Origin crashed or reset the connection
• Response headers too large (over Cloudflare's limit)
• Firewall on the origin blocking Cloudflare IPs

How to fix it

• Check the origin server's error logs
• Allow-list Cloudflare IP ranges
• Reduce cookie/header size

Defined in: Cloudflare · Link to 520

Cloudflare tried to connect to your server and the connection was refused.

Common causes

• Web server (nginx/Apache) stopped
• Firewall blocking Cloudflare IPs

How to fix it

• Start the web server
• Allow Cloudflare IP ranges in the firewall

Defined in: Cloudflare · Link to 521

Cloudflare couldn't complete a TCP handshake with your server in time.

Common causes

• Origin overloaded or offline
• Firewall silently dropping Cloudflare traffic
• Wrong origin IP in DNS

How to fix it

• Check the server is online and not overloaded
• Verify the DNS A/AAAA records in Cloudflare
• Allow Cloudflare IPs

Defined in: Cloudflare · Link to 522

Usually a DNS or routing problem between Cloudflare and the origin.

Common causes

• Wrong origin IP address in Cloudflare DNS
• Routing problems at the hosting provider

How to fix it

• Correct the DNS records
• Contact the hosting provider

Defined in: Cloudflare · Link to 523

The connection succeeded, but the origin took longer than Cloudflare's timeout (100 s by default) to send the response.

Common causes

• Long-running request (imports, reports)
• Slow database or overloaded origin

How to fix it

• Move long tasks to background jobs
• Optimise the slow endpoint
• Enterprise plans can raise the timeout

Defined in: Cloudflare · Link to 524

With SSL mode Full or Full (strict), Cloudflare couldn't negotiate TLS with your server.

Common causes

• No SSL certificate installed on the origin
• No common TLS version or cipher
• Origin not listening on port 443

How to fix it

• Install a certificate on the origin (a free Cloudflare Origin CA certificate works)
• Enable TLS 1.2+ and modern ciphers

Defined in: Cloudflare · Link to 525

In Full (strict) mode the origin must present a valid certificate for the hostname; it didn't.

Common causes

• Expired or self-signed origin certificate
• Certificate doesn't cover the hostname

How to fix it

• Renew or replace the origin certificate
• Use a Cloudflare Origin CA certificate

Defined in: Cloudflare · Link to 526

Railgun was a Cloudflare WAN optimiser that has been discontinued, so this code is now mostly historical.

Common causes

• Railgun listener down or unreachable

How to fix it

• Railgun is discontinued — remove it from the setup

Defined in: Cloudflare (deprecated) · Link to 527

On Cloudflare, 530 accompanies a 1xxx error (such as 1016 Origin DNS error) — the 1xxx code in the page explains the actual problem. Pantheon uses 530 for sites that have been frozen due to inactivity.

Common causes

• Cloudflare can't resolve the origin hostname (error 1016)
• Pantheon site frozen

How to fix it

• Look up the 1xxx error number shown on the page and fix the DNS/origin settings
• Pantheon: unfreeze the site in the dashboard

Defined in: Cloudflare; Pantheon · Link to 530

Not defined by any standard; some proxies and client libraries use it to signal a read timeout behind a proxy.

Common causes

• Slow upstream server behind a proxy

How to fix it

• Investigate the upstream server's performance or raise the proxy read timeout

Defined in: Informal convention (some HTTP proxies) · Link to 598

Not defined by any standard; used by some proxies and HTTP client libraries for a connect timeout.

Common causes

• Server unreachable or firewalled
• Network problems between proxy and server

How to fix it

• Check the server is reachable and the firewall allows the connection

Defined in: Informal convention (some HTTP proxies and clients) · Link to 599