< HTTP/1.1 426 Upgrade Required426 Upgrade Required
The server refuses to perform the request using the current protocol and requires the client to upgrade to a different protocol.
- Cacheable
- Only with explicit freshness
- Retry?
- Yes: upgrade the protocol first
- Usually sent by
- Origin app or server
- Often confused with
- 101
On this page
TL;DR:
426 Upgrade Requiredmeans “this request is not acceptable as-is; try again using a different protocol.”
What 426 Is Actually For
A 426 Upgrade Required response tells the client that the server understood the request, but refuses to process it over the current protocol. The server is effectively saying: “come back using this upgraded protocol instead.”
That is different from a redirect. The URL might stay the same. The protocol expectations change.
Where You Might Realistically See It
The clearest real-world case is a WebSocket endpoint. If a client sends a normal HTTP request to an endpoint that only makes sense as a WebSocket upgrade, the server can answer with 426 and indicate that it expects Upgrade: websocket.
Example:
HTTP/1.1 426 Upgrade Required
Upgrade: websocket
Connection: Upgrade
Why It Feels Rare
Most web traffic does not use 426 because browsers and common web infrastructure prefer other patterns:
- HTTPS enforcement usually uses
301or308 - HTTP/2 and HTTP/3 are usually negotiated automatically
- WebSocket libraries often fail the upgrade directly rather than surfacing 426 explicitly
So 426 is valid, but specialized.
How To Read It Correctly
When you get a 426, ask:
- what protocol is the server demanding
- does my client know how to switch to it
- am I talking to a special endpoint with stricter expectations
If the answer is “this should have been a WebSocket,” then the fix is usually not in status-code handling. The fix is using the right client and handshake.
426 vs 505
These are easy to confuse:
426means the server is willing to continue if the client upgrades505means the request’s HTTP version is unsupported and the current exchange cannot proceed as sent
So 426 is more like “different protocol, please,” while 505 is “this version is not acceptable here.”
The Practical Rule
If you are building a normal website or JSON API, you probably will not use 426 often. If you are building upgrade-driven endpoints, it becomes more relevant.
Try it with curl
Call a WebSocket-only endpoint with a plain request.
curl -i https://api.example.com/socket
Example output (illustrative, not captured from a real server):
HTTP/1.1 426 Upgrade Required
Upgrade: websocket
Connection: Upgrade
The Upgrade header names what the server wants. Repeat the request with the handshake headers from 101 Switching Protocols to see the upgrade succeed.
Related Status Codes
Frequently asked questions
What does 426 Upgrade Required mean?
It means the server will not process the request over the current protocol, but may accept it if the client reconnects using a required upgrade.
When is 426 Upgrade Required used?
It is most relevant when a server expects an upgrade flow, such as WebSocket or another explicit protocol change signaled through `Upgrade`.
How do I fix a 426 error?
Read the `Upgrade` header, then reconnect using the required protocol if your client supports it.
What is the difference between 426 and 301 for HTTPS?
301 redirects to a different URL and is what browsers expect for HTTP-to-HTTPS moves. 426 is a protocol-level requirement, not a URL rewrite.
Sources
Related
402 Payment Required
Reserved for future use in digital payment systems. Learn about this experimental status code and modern payment verification alternatives.
418 I'm a Teapot: Origin and Real-World Use
418 I'm a teapot comes from the 1998 April Fools RFC 2324. See why RFC 9110 reserves it, why Node and Go keep it, and why some sites return it to bots.
101 Switching Protocols
The server is switching to a different protocol as requested by the client. Learn about WebSocket upgrades and protocol negotiation.
400 Bad Request
400 Bad Request means the server could not parse your request. Find which layer sent it, fix bad JSON and oversized cookies or headers, and reproduce with curl.