HTTP status codes, with a security lens.
Every HTTP status code explained in plain language — plus what each one means for offensive testing and defense, from 401-vs-403 access control to 429 rate limiting and 500 error disclosure.
1xx Informational
The request was received and the process is continuing.
2xx Success
The request was successfully received, understood, and accepted.
3xx Redirection
Further action is needed to complete the request.
- 301 Moved Permanently
The resource has permanently moved.
- 302 Found
The resource temporarily resides at a different URL.
- 303 See Other
Redirect to another URL using GET.
- 304 Not Modified
The cached version is still valid.
- 307 Temporary Redirect
Temporary redirect preserving the method.
- 308 Permanent Redirect
Permanent redirect preserving the method.
4xx Client Error
The request contains bad syntax or cannot be fulfilled.
- 400 Bad Request
The server cannot process a malformed request.
- 401 Unauthorized
Authentication is required and has failed or is missing.
- 402 Payment Required
Reserved for future or payment-gated use.
- 403 Forbidden
The server understood but refuses to authorize the request.
- 404 Not Found
The requested resource does not exist.
- 405 Method Not Allowed
The HTTP method is not supported for this resource.
- 406 Not Acceptable
No representation matches the Accept headers.
- 408 Request Timeout
The client took too long to send the request.
- 409 Conflict
The request conflicts with the current state.
- 410 Gone
The resource is permanently unavailable.
- 413 Content Too Large
The request payload is too large.
- 415 Unsupported Media Type
The payload format is unsupported.
- 422 Unprocessable Content
The request is well-formed but semantically invalid.
- 429 Too Many Requests
The client has sent too many requests.
- 431 Request Header Fields Too Large
The request headers are too large.
5xx Server Error
The server failed to fulfill a valid request.
- 500 Internal Server Error
A generic server-side error occurred.
- 501 Not Implemented
The server does not support the functionality.
- 502 Bad Gateway
An upstream server returned an invalid response.
- 503 Service Unavailable
The server is temporarily unable to handle the request.
- 504 Gateway Timeout
An upstream server did not respond in time.
- 505 HTTP Version Not Supported
The HTTP version is not supported.
- 511 Network Authentication Required
The client must authenticate to gain network access.