HTTP Status Code Reference
Complete reference of all HTTP status codes with descriptions, categories, and common use cases. Search by code number or description.
Status Codes
31 codes| Code | Name | Description | Category |
|---|---|---|---|
| 100 | Continue | The server has received the request headers and the client should proceed to send the body. | 1xx |
| 101 | Switching Protocols | The requester has asked the server to switch protocols and the server has agreed. | 1xx |
| 200 | OK | Standard response for successful HTTP requests. | 2xx |
| 201 | Created | The request has been fulfilled, resulting in the creation of a new resource. | 2xx |
| 204 | No Content | The server successfully processed the request but is not returning any content. | 2xx |
| 301 | Moved Permanently | The requested resource has been permanently moved to a new URL. | 3xx |
| 302 | Found | The requested resource temporarily resides under a different URL. | 3xx |
| 303 | See Other | The response can be found under another URI using the GET method. | 3xx |
| 304 | Not Modified | Indicates the resource has not been modified since the last request. | 3xx |
| 307 | Temporary Redirect | The request should be repeated with another URI, but future requests should still use the original. | 3xx |
| 308 | Permanent Redirect | The request and all future requests should be repeated using another URI. | 3xx |
| 400 | Bad Request | The server cannot process the request due to client error. | 4xx |
| 401 | Unauthorized | Authentication is required and has failed or not been provided. | 4xx |
| 403 | Forbidden | The request was valid but the server refuses to respond. | 4xx |
| 404 | Not Found | The requested resource could not be found. | 4xx |
| 405 | Method Not Allowed | The request method is not supported for the requested resource. | 4xx |
| 406 | Not Acceptable | The requested resource is only capable of generating content not acceptable according to Accept headers. | 4xx |
| 407 | Proxy Authentication Required | The client must first authenticate with the proxy. | 4xx |
| 408 | Request Timeout | The server timed out waiting for the request. | 4xx |
| 409 | Conflict | The request conflicts with the current state of the server. | 4xx |
| 410 | Gone | The requested resource is permanently gone and no forwarding address. | 4xx |
| 411 | Length Required | The request did not specify the length of its content. | 4xx |
| 429 | Too Many Requests | The user has sent too many requests in a given amount of time (rate limiting). | 4xx |
| 431 | Request Header Fields Too Large | The server is unwilling to process the request because header fields are too large. | 4xx |
| 451 | Unavailable For Legal Reasons | The resource is unavailable due to legal demands. | 4xx |
| 500 | Internal Server Error | Generic server error when no specific message is suitable. | 5xx |
| 501 | Not Implemented | The server does not support the functionality required. | 5xx |
| 502 | Bad Gateway | The server received an invalid response from the upstream server. | 5xx |
| 503 | Service Unavailable | The server is temporarily unable to handle the request (overloaded or down). | 5xx |
| 504 | Gateway Timeout | The server did not receive a timely response from an upstream server. | 5xx |
| 511 | Network Authentication Required | The client needs to authenticate to gain network access. | 5xx |
Why Know HTTP Status Codes?
HTTP status codes are essential for web security testing. A 403 might indicate a properly restricted resource, while a 405 on an API endpoint could reveal hidden functionality. 500 errors often indicate input validation issues that lead to SQL injection or command injection. Understanding status codes helps bug bounty hunters interpret server behavior during testing.