HTTP status codes & headers

How it works

Every HTTP response carries a three-digit status code that sums up what happened, plus a set of headers with metadata: content type, caching, cookies, CORS or security. This reference gathers the registered codes and the most used headers, each with a short explanation.

Under Status codes, type an exact number (404), a prefix (5 shows every server error) or a word (redirect, limit). Each code shows its official name, the RFC that defines it and what it is used for. Color tells the family apart: green for success, yellow for client errors and red for server errors.

Under Headers, search by name or topic: cache, cors, cookie, security. You see whether the header belongs in the request, the response or both, and what it controls.

It helps you pick the right code when designing an API, understand an error in the logs, or remember what Vary or Retry-After did. To analyze the real headers of a response, use the HTTP header analyzer.

Examples

429

429  Too Many Requests · RFC 6585
     Rate limit exceeded; see Retry-After.

cors

Access-Control-Allow-Credentials  Response  CORS: allows sending cookies or credentials.
Access-Control-Allow-Headers      Response  CORS: headers allowed in the actual request.
Access-Control-Allow-Methods      Response  CORS: methods allowed in the actual request.
Access-Control-Allow-Origin       Response  CORS: origins allowed to read the response.

Frequently asked questions