The HTTP reference · 78 status codes · 90 headers
The HTTP reference you
keep open in a tab.
Every status code, header, method and cookie attribute — with the spec behind it, the gotchas that bite in production, and the fix. Plus tools to check your own responses.
Look up a status code, header or error…/zsh — every token is a link
$ curl -v https://api.example.com/v1/orders/42
> GET /v1/orders/42 HTTP/2
> host: api.example.com
> authorization: Bearer eyJhbGciOi…
> accept: application/json
> if-none-match: "33a64df5"
>
< HTTP/2 200
< content-type: application/json; charset=utf-8
< cache-control: private, max-age=60
< etag: "8c1f02b7"
< vary: Accept-Encoding
< set-cookie: sid=…; Secure; HttpOnly; SameSite=Lax
< strict-transport-security: max-age=63072000Status codes
Every code, one screen
4xxClient error
- 400Bad Request
- 401Unauthorized
- 402Payment Required
- 403Forbidden
- 404Not Found
- 405Method Not Allowed
- 406Not Acceptable
- 407Proxy Authentication Required
- 408Request Timeout
- 409Conflict
- 410Gone
- 411Length Required
- 412Precondition Failed
- 413Content Too Large
- 414URI Too Long
- 415Unsupported Media Type
- 416Range Not Satisfiable
- 417Expectation Failed
- 418I'm a teapot
- 419Page Expired
- 421Misdirected Request
- 422Unprocessable Content
- 423Locked
- 424Failed Dependency
- 425Too Early
- 426Upgrade Required
- 428Precondition Required
- 429Too Many Requests
- 431Request Header Fields Too Large
- 444No Response
- 451Unavailable For Legal Reasons
- 460Client Closed Connection
- 463Too Many Forwarded IP Addresses
- 464Incompatible Request Protocol
- 497HTTP Request Sent to HTTPS Port
- 499Client Closed Request
5xxServer error
- 500Internal Server Error
- 501Not Implemented
- 502Bad Gateway
- 503Service Unavailable
- 504Gateway Timeout
- 505HTTP Version Not Supported
- 506Variant Also Negotiates
- 507Insufficient Storage
- 508Loop Detected
- 509Bandwidth Limit Exceeded
- 510Not Extended
- 511Network Authentication Required
- 520Web Server Returned an Unknown Error
- 521Web Server Is Down
- 522Connection Timed Out
- 523Origin Is Unreachable
- 524A Timeout Occurred
- 525SSL Handshake Failed
- 526Invalid SSL Certificate
- 529Site Is Overloaded
- 530Origin DNS Error
- 561Unauthorized
Headers
90 →Methods
10 →Something’s broken
Paste the error. Get the fix.
- No 'Access-Control-Allow-Origin' header is present on the requested resourceWhy the browser blocked it, and the fix for your stack
- ERR_TOO_MANY_REDIRECTSFind the loop: Cloudflare SSL mode, proxies, app redirects
- 502 Bad Gateway — nginxRead the error log line, fix the upstream
- upstream timed out (110: Connection timed out)Which timeout fired, and whether to raise it
- 413 Request Entity Too Largeclient_max_body_size and every other limit in the path
- Cookie set but not sent on the next requestSameSite, Secure, Domain and Path checks
Tools
Check your own responses
Header InspectorFetch any URL and analyze its response headers.CORS DebuggerSimulate preflight requests and debug CORS policies.CSP Evaluator & BuilderGrade a Content-Security-Policy and build a strict one.curl Command ExplainerExplain a curl command, see the request it sends, convert to fetch or Python.Redirect & Canonical AuditorTrace redirect hops, canonicals, and indexing signals.Cache-Control BuilderBuild Cache-Control headers with plain-English explanations.Set-Cookie BuilderCompose Set-Cookie headers with attribute validation.Status Code PickerFind the right status code for your API response.Message ParserPaste and color-code raw HTTP messages.
Guides
18 →- 01API Rate Limiting: Algorithms, Headers and 429Rate limit an HTTP API: fixed window, sliding window, token bucket and leaky bucket compared, plus 429, Retry-After, RateLimit headers, nginx and Express.
- 02Content Negotiation: Accept, Languages and CachesImplement HTTP content negotiation with Accept headers, q-values, Vary and 406 responses, with Express, Django and nginx examples and language SEO guidance.
- 03Cookie Security: HttpOnly, SameSite, and Secure FlagsA comprehensive guide to understanding and implementing secure HTTP cookies to protect against XSS, CSRF, and session hijacking attacks.
- 04Cross-Origin Resource Sharing (CORS)Master Cross-Origin Resource Sharing (CORS) for secure cross-origin HTTP requests. Learn preflight requests, headers, credentials, and common error solutions.