Search every HTTP status code, with causes and fixes.
An HTTP status code is the three-digit number a server sends at the start of every response to say whether the request worked and, if not, whose side the problem is on. The first digit gives the class. 1xx codes are interim information, such as 103 Early Hints. 2xx means success: 200 OK, 201 Created, 204 No Content. 3xx means the client must go somewhere else or use its cache: 301, 302, 304, 307, 308. 4xx means the request was wrong: 400, 401, 403, 404, 429. 5xx means the server failed on a valid request: 500, 502, 503, 504. This page lists every code in the IANA HTTP Status Code Registry, from 100 Continue to 511 Network Authentication Required, using the definitions in RFC 9110 (HTTP Semantics, 2022) and the RFCs that add codes such as 429 and 451.
Each code shows its class, whether the same request can be retried, and whether a response is cacheable by default. Cacheable by default comes from RFC 9110 section 15.1: 200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414 and 501, plus 451 from RFC 7725. Other codes are cached only when the response carries explicit freshness headers such as Cache-Control. The retry label is practical guidance, not part of the RFCs. Yes means a short wait and a second try often works, as with 429, 502, 503 and 504. No means repeating the request gives the same answer until something changes, as with 400 or 404. Maybe means it depends on the cause, as with 500. For the frequent codes you also get common causes and fixes, such as raising nginx client_max_body_size, which defaults to 1 MB, when you see 413.
401 and 403 differ in what is missing. 401 Unauthorized means the server does not know who you are: send valid credentials. 403 Forbidden means it knows who you are and still says no. 301 and 302 differ in how long the move lasts. 301 and 308 are permanent and search engines move the ranking to the new address. 302 and 307 are temporary. 307 and 308 also forbid changing the method, so a POST stays a POST, while old clients may turn a POST into a GET after 301 or 302. 404 means nothing is known at that address, and 410 Gone means it was removed on purpose. 502 means a proxy got a bad reply from the app behind it, 503 means the server is overloaded or in maintenance, and 504 means the app behind the proxy was too slow.
It lists registered codes only. Some servers add their own unregistered codes, such as Cloudflare's 520 to 527 or nginx's 499, and those are not in the list. APIs may also use the registered codes in their own way, so an API's documentation wins over a general reference. The search runs in your browser. What you type is not stored, not put in the page address and not sent anywhere.
401 means the request has no valid credentials, so logging in or sending a fresh token can fix it. 403 means the server knows who you are and refuses anyway, for example a user without the admin role. A new password will not turn a 403 into a 200.
Use 301 (or 308) when the move is permanent, for example http to https or a renamed page, so search engines transfer ranking to the new address. Use 302 (or 307) for a temporary move such as a login redirect. Browsers cache 301 for a long time, so test with a 302 first.
429, 502, 503 and 504 are usually safe to retry after a pause, and 408 and 425 can be retried right away. Back off: wait 1 s, then 2 s, then 4 s, and honour a Retry-After header if there is one. Only retry POST requests if the server supports idempotency keys, or you may create duplicates.
A proxy or load balancer such as nginx reached the app behind it and got no valid reply. The usual cause is that the app crashed, is restarting or listens on a different port than the proxy expects. Check the app process and read both logs.
The browser sent a conditional request with If-None-Match or If-Modified-Since and the file has not changed, so the server sent no body, only headers. It saves bandwidth and is a sign caching works. Hard refresh to force a full 200.
It comes from RFC 2324, an April Fools joke from 1998. The IANA registry keeps 418 as (Unused) and RFC 9110 reserves it so it cannot be reused for something else. Some sites still return it on purpose.