1xx
Informational
100ContinueHeaders received; client should send the request body.101Switching ProtocolsServer is switching protocols as asked — e.g. upgrading to WebSocket.102ProcessingWebDAV: request accepted, still working, no response yet.103Early HintsPreload hints sent before the final response.2xx
Success
200OKThe request succeeded. The everyday healthy response.201CreatedRequest succeeded and a new resource was created — typical POST result.202AcceptedAccepted for processing, but not finished. Async work.203Non-Authoritative InformationReturned metadata came from a copy or proxy, not the origin.204No ContentSucceeded, nothing to return. Common on DELETE and beacons.205Reset ContentSucceeded; client should reset the form/view.206Partial ContentRange request satisfied — resumable downloads, media seeking.207Multi-StatusWebDAV: multiple independent status codes in one body.208Already ReportedWebDAV: members already enumerated, not repeated.226IM UsedResponse is the result of delta encoding on the resource.3xx
Redirection
300Multiple ChoicesSeveral representations exist; client or user picks one.301Moved PermanentlyResource moved for good. Clients and search engines update the URL.302FoundTemporary redirect. Watch open redirects here — a 302 to an attacker domain is a phishing trick.303See OtherRedirect to fetch the result with GET — post/redirect/get.304Not ModifiedCached copy is still good; no body sent. Heavy in normal traffic.305Use ProxyDeprecated. Must access through the named proxy.307Temporary RedirectLike 302 but the method is preserved (POST stays POST).308Permanent RedirectLike 301 but the method is preserved.4xx
Client error
Where scanning, brute force, and enumeration show up in access logs.
400Bad RequestMalformed syntax the server won't process. A flood of these can be a fuzzer.401UnauthorizedAuthentication required or failed. Bursts across accounts = credential attack.402Payment RequiredReserved; rarely used outside some APIs.403ForbiddenAuthenticated but not allowed. A run of 403s on admin paths is someone probing access.404Not FoundNo such resource. Many 404s from one source is a scanner mapping your site.405Method Not AllowedMethod not supported for that resource — e.g. PUT where only GET is allowed.406Not AcceptableCan't produce a response matching the client's Accept headers.407Proxy Authentication RequiredMust authenticate with the proxy first.408Request TimeoutClient took too long to send the request.409ConflictRequest conflicts with current state — e.g. edit collision.410GoneResource intentionally removed and won't return.411Length RequiredContent-Length header is missing and required.412Precondition FailedA conditional header (If-Match, etc.) didn't hold.413Payload Too LargeBody exceeds the server's limit. Oversized POSTs can be an upload-abuse attempt.414URI Too LongRequest URI past the limit — sometimes an overflow or injection attempt.415Unsupported Media TypeBody format the server won't accept.416Range Not SatisfiableRequested range is outside the resource size.417Expectation FailedThe Expect header couldn't be met.418I'm a teapotApril Fools' RFC joke. Some services use it as a honeypot/decoy tell.421Misdirected RequestSent to a server that can't produce a response for this authority.422Unprocessable ContentSyntax fine, semantics wrong — common API validation failure.423LockedWebDAV: resource is locked.424Failed DependencyWebDAV: a prior request it depended on failed.425Too EarlyServer won't risk replaying an early-data request.426Upgrade RequiredClient must switch to a different protocol (e.g. TLS).428Precondition RequiredServer requires the request to be conditional.429Too Many RequestsRate limited. A spike means either abuse or a misbehaving client — worth watching.431Request Header Fields Too LargeHeaders exceed limits — occasionally a header-smuggling probe.451Unavailable For Legal ReasonsBlocked for legal/censorship reasons.5xx
Server error
The request was fine; the server broke. A spike often means an outage — or that an attack landed.
500Internal Server ErrorGeneric server failure. A sudden rise on one endpoint can mean a payload triggered an exception.501Not ImplementedServer doesn't support the method at all.502Bad GatewayUpstream returned an invalid response. Proxy/load-balancer can't reach the backend.503Service UnavailableOverloaded or down for maintenance. Sustained 503s can be the symptom of a DoS.504Gateway TimeoutUpstream didn't answer in time. Backend hang or resource exhaustion.505HTTP Version Not SupportedServer won't support the HTTP version used.506Variant Also NegotiatesContent-negotiation misconfiguration on the server.507Insufficient StorageWebDAV: server is out of space to complete the request.508Loop DetectedWebDAV: infinite loop while processing.510Not ExtendedFurther extensions are required to fulfill the request.511Network Authentication RequiredCaptive portal — authenticate to the network first.