W3docs

HTTP Status Messages

A clear reference to HTTP status codes (1xx–5xx) with the most common ones explained and a fetch() example that branches on response.status.

Every time a browser loads a page, submits a form, or your JavaScript makes a fetch() call, the server answers with a three-digit HTTP status code. This code tells the client whether the request succeeded, was redirected, failed because of something the client did, or failed on the server side. The browser uses it automatically — it follows redirects, shows its own error page for some codes, and re-uses cached content for others — but as a developer you also read these codes directly: a form posts and you branch on the response, or a fetch() resolves and you check response.ok (which is simply "status in the 200–299 range").

Here you can find the list of Hypertext Transfer Protocol (HTTP) response status codes. These codes answer the request a client makes to a server — whether that request uses GET, POST, or another HTTP method — and they are grouped into 5 classes by their first digit. Knowing them helps you debug broken links, wrong URLs, failed form submissions, and unexpected API responses. Let’s go through each class:

Danger

If you receive a response that is not included in this list, this means that it is a non-standard response, perhaps custom to the software of the server.

Handling status codes in JavaScript

When you submit a form or call an API with fetch(), the request succeeds (the promise resolves) even when the server returns a 4xx or 5xx error — a 404 or 500 is still a valid HTTP response, not a network failure. So you must inspect the status yourself. The handy shortcut is response.ok, which is true only for the 200–299 range; for anything else you branch on response.status to react appropriately:

const form = document.querySelector("#signup");

form.addEventListener("submit", async (event) => {
  event.preventDefault();

  const response = await fetch("/api/signup", {
    method: "POST",
    body: new FormData(form),
  });

  if (response.ok) {
    // 200–299: success
    window.location.href = "/welcome";
  } else if (response.status === 401) {
    showMessage("Please log in first.");
  } else if (response.status === 422) {
    // Validation errors returned as JSON
    const data = await response.json();
    showMessage(data.error);
  } else if (response.status === 429) {
    // Rate limited — respect the Retry-After header
    const wait = response.headers.get("Retry-After");
    showMessage(`Too many attempts. Try again in ${wait}s.`);
  } else if (response.status >= 500) {
    showMessage("Server error — please try again later.");
  } else {
    showMessage(`Unexpected error (${response.status}).`);
  }
});

Note that fetch() only rejects on genuine network problems (no connection, CORS block, DNS failure), so wrapping the call in try…catch handles those, while the if/else above handles the HTTP status itself.

Info

Most common codes to know first. If you only memorize a handful, make it these: 200 (OK), 301 (Moved Permanently), 302 (Found / temporary redirect), 401 (Unauthorized), 403 (Forbidden), 404 (Not Found), and 500 (Internal Server Error). They cover the vast majority of what you'll see in browser dev tools and server logs.

1xx: Information

Status codeMessageDescription
100ContinueMeans that the server has received the request headers and the client should continue to send the request body.
101Switching ProtocolsMeans that the client, who made a request, has asked the server to change protocols (for example, to upgrade to a WebSocket connection).
102ProcessingA WebDAV code meaning the server has accepted the request but has not yet completed it; used to keep the client from timing out on a long operation.
103Early HintsDefined in RFC 8297. Lets the server send some response headers (such as Link headers that preload resources) before the final response, so the browser can start fetching assets sooner.

2xx: Successful

Status codeMessageDescription
200OKMeans that the request is OK. It is standard response for successful HTTP requests.
201CreatedMeans that the request has been fulfilled and a new resource is created.
202AcceptedMeans that the request has been accepted for processing, but the processing is going on.
203Non-Authoritative InformationMeans that the request has been successfully processed, but it is returning information which may be from another source.
204No ContentMeans that the request has been successfully processed, but it is not giving any content.
205Reset ContentMeans that the request has been processed, but it is not returning any content and it requires that the requester reset the document view.
206Partial ContentMeans that the server commits only a part of the resource, because of a range header, which was sent by the client.

3xx: Redirection

Status codeMessageDescription
300Multiple ChoicesIndicates multiple options for the resource that the client may follow.
301Moved PermanentlyMeans that the page has been permanently moved to a new URL. Browsers and search engines update their references, so a 301 passes link equity to the new URL and is the correct choice for SEO-friendly redirects.
302FoundMeans that the requested page has been moved to a new URL temporarily. Search engines keep the original URL indexed, so use 302 (not 301) when the move is short-lived, such as during maintenance or A/B testing.
303See OtherMeans that the response to the request can be found at another URL, which the client should retrieve with GET. Commonly used after a form POST to redirect to a result page.
304Not ModifiedMeans that the requested resource hasn't been modified since it was last cached. The server sends no body, so the browser re-uses its cached copy — this saves bandwidth and speeds up repeat visits.
307Temporary RedirectMeans that the requested page has been moved to a new URL temporarily. Unlike 302, the client must keep the original request method (a POST stays a POST).
308Permanent RedirectMeans that the requested resource has been permanently moved to a new URL.

Codes not listed here (such as 305 and 306) are deprecated, rare, or extension-specific.

4xx: Client Error

Status codeMessageDescription
400Bad RequestMeans that the request cannot be fulfilled due to bad syntax or invalid data.
401UnauthorizedMeans the client is not authenticated — valid credentials are missing or wrong. The server doesn't yet know who you are, so it asks you to log in. (Note: the name says "Unauthorized" but it really means "Unauthenticated.")
402Payment RequiredIs reserved for future use.
403ForbiddenMeans the client is authenticated but not authorized — the server knows who you are, but you don't have permission for this resource. Unlike 401, sending credentials again won't help.
404Not FoundMeans that the requested page cannot be found at the moment, but it may be available again in the future.
405Method Not AllowedMeans that the request was made of a page that uses an unsupported request method for that page.
406Not AcceptableMeans that the server can only generate an answer which the client doesn't accept.
407Proxy Authentication RequiredMeans that the client first authenticate itself with the proxy.
408Request TimeoutMeans that the server timed out waiting for the request.
409ConflictMeans that the request cannot be completed, because of a conflict in the request.
410GoneMeans that the requested page is not available anymore.
411Length RequiredMeans that the content length is not defined and the server won't accept the request without it.
412Precondition FailedMeans that precondition, which is given in the request, is evaluated to false by the server.
413Request Entity Too LargeMeans that the request entity is too large and that's why the server won't accept the request.
414Request-URI Too LongMeans that the URL is too long and that's why the server won't accept the request. It happens when you convert a POST request to a GET request with a long query information.
415Unsupported Media TypeMeans that the media type is not supported and that's why the server won't accept the request.
416Requested Range Not SatisfiableMeans that the client asked for a part of the file but the server cannot supply that part.
417Expectation FailedMeans that the server cannot meet the requirements of the Expect request header field.
418I'm a TeapotA joke code from RFC 2324 (the Hyper Text Coffee Pot Control Protocol). It is not a real error, but some APIs return it deliberately, so you may encounter it in the wild.
422Unprocessable ContentMeans the request was well-formed but contains semantic errors that prevent it from being processed — commonly returned by APIs when form or JSON data fails validation.
429Too Many RequestsMeans the client has sent too many requests in a given amount of time ("rate limiting"). The response often includes a Retry-After header telling you how long to wait before trying again.
451Unavailable For Legal ReasonsMeans the requested resource is unavailable due to legal demands, such as censorship or a takedown order (the number references the novel Fahrenheit 451).

Codes not listed here (such as 419, 420, and several in the 423–431 range) are rare, framework-specific, or non-standard. A few — like 421 (Misdirected Request, used in HTTP/2) and 451 above — are standardized but uncommon in everyday work.

5xx: Server Error

Status codeMessageDescription
500Internal Server ErrorIs a generic error and users receive this error message when there is no more suitable specific message.
501Not ImplementedMeans that the server doesn't recognize the request method or it lacks the ability to fulfill the request.
502Bad GatewayMeans that a server acting as a gateway, reverse proxy, or load balancer received an invalid response from the upstream application server — often because that backend crashed or returned malformed output.
503Service UnavailableMeans that the server is temporarily unable to handle the request (overloaded or down for maintenance). Like 429, the response may include a Retry-After header telling clients and crawlers when to try again, which is why 503 is the SEO-safe code to use during planned downtime.
504Gateway TimeoutMeans that a server acting as a gateway, reverse proxy, or load balancer did not get a response in time from the upstream server. It points to a slow or unresponsive backend rather than to the proxy itself.
505HTTP Version Not SupportedMeans that the HTTP protocol version used in the request is not supported by the server.
507Insufficient StorageA WebDAV code meaning the server cannot store the representation needed to complete the request (it is out of storage space).
508Loop DetectedA WebDAV code meaning the server detected an infinite loop while processing the request and terminated it.
511Network Authentication RequiredMeans that the client needs to authenticate to gain network access (often seen behind captive-portal Wi-Fi).

The status a server returns often depends on the request itself. To go deeper, see:

Practice

Practice
A logged-in user requests a page they are not allowed to see. Which status code should the server return?
A logged-in user requests a page they are not allowed to see. Which status code should the server return?
Practice
You permanently move a page to a new URL and want search engines to pass ranking signals to the new address. Which redirect code should you use?
You permanently move a page to a new URL and want search engines to pass ranking signals to the new address. Which redirect code should you use?
Practice
A form POST succeeds and the server wants to tell the browser to clear the form fields without sending any new page content. Which status code fits best?
A form POST succeeds and the server wants to tell the browser to clear the form fields without sending any new page content. Which status code fits best?
Was this page helpful?