HTTP Status Code
Reference

When you see it

• –After sending a request with an Expect: 100-continue header
• –When uploading a large body and the server signals it is ready to receive it

Headers to check

When you see it

• –During a WebSocket handshake
• –When upgrading an HTTP/1.1 connection to another protocol

Headers to check

When you see it

• –During long-running WebDAV operations
• –To keep a client from timing out while a request is processed

When you see it

• –When a server hints at resources to preload before the full response is ready
• –On CDNs that support early hints for performance

Headers to check

When you see it

• –A standard successful GET, POST, or other request
• –The body contains the requested representation

When you see it

• –After a successful POST or PUT that creates a resource
• –A Location header usually points to the new resource

Headers to check

When you see it

• –When work is queued asynchronously
• –On APIs that return a job ID to poll later

When you see it

• –After a successful DELETE
• –On PUT/PATCH requests that intentionally return nothing

When you see it

• –When resuming a download
• –During chunked/range requests for large files or media streaming

Headers to check

When you see it

• –When a URL has permanently changed
• –On HTTP-to-HTTPS or non-www-to-www redirects

Headers to check

When you see it

• –On temporary redirects
• –After a login or form post that redirects elsewhere

Headers to check

When you see it

• –After a POST, to redirect the client to a result page via GET
• –In the Post/Redirect/Get pattern

Headers to check

When you see it

• –On conditional requests with If-Modified-Since or If-None-Match
• –When a CDN or browser cache revalidates

Headers to check

When you see it

• –On temporary redirects where the method (e.g. POST) must be preserved
• –As a method-safe alternative to 302

Headers to check

When you see it

• –On permanent redirects where the method must be preserved
• –As a method-safe alternative to 301

Headers to check

When you see it

• –A malformed request body or query string
• –Invalid JSON or missing required parameters

When you see it

• –When a request lacks valid authentication credentials
• –When a token or session has expired

Headers to check

When you see it

• –When access is denied regardless of authentication
• –When an anti-bot system declines to serve a request
• –On geo-restricted or IP-blocked content

Headers to check

When you see it

• –When a URL does not exist
• –When a resource was removed without a redirect

When you see it

• –Sending POST to a GET-only endpoint (or vice versa)
• –When an API route does not allow the chosen verb

Headers to check

When you see it

• –When the Accept, Accept-Language, or Accept-Encoding headers cannot be satisfied
• –On strict content negotiation

Headers to check

When you see it

• –When a request goes through a proxy that needs credentials
• –When proxy username/password is missing or wrong

Headers to check

When you see it

• –When the client is too slow to send a complete request
• –On idle keep-alive connections that the server closes

Headers to check

When you see it

• –On concurrent edits to the same resource
• –When a uniqueness constraint is violated

When you see it

• –When content was intentionally and permanently removed
• –As a stronger signal than 404 to drop the URL

When you see it

• –On POST/PUT requests sent without Content-Length
• –When chunked encoding is not accepted

Headers to check

When you see it

• –On file uploads that exceed a size limit
• –When posting an oversized JSON body

Headers to check

When you see it

• –When a GET request packs too much data into the query string
• –On extremely long encoded URLs

When you see it

• –When the Content-Type does not match what the endpoint expects
• –Posting form data to a JSON-only endpoint

Headers to check

When you see it

• –On endpoints that use it as a playful catch-all
• –Occasionally used by services as a deliberate "blocked" signal

When you see it

• –On validation failures in a syntactically valid request
• –Common in REST/JSON APIs for field-level errors

When you see it

• –During WebDAV operations on a locked resource

When you see it

• –On requests sent in TLS 1.3 early data (0-RTT)
• –When replay protection is enforced

When you see it

• –After making too many requests too quickly
• –After an API quota is exhausted
• –When a per-IP or per-account rate limit is hit

Headers to check

When you see it

• –On content blocked by law or court order
• –On geo-restricted content blocked for legal compliance

When you see it

• –On an unhandled exception in server code
• –When a backend dependency fails unexpectedly

When you see it

• –When an HTTP method is not supported at all
• –On unimplemented API features

When you see it

• –When a load balancer or reverse proxy cannot reach the origin
• –During origin deploys or crashes

Headers to check

When you see it

• –During maintenance windows
• –When the server is overloaded
• –On interstitial anti-bot challenge pages

Headers to check

When you see it

• –When the origin is too slow to respond
• –On long-running requests that exceed proxy timeouts

Headers to check

When you see it

• –When a client uses an HTTP version the server refuses
• –On misconfigured or very old servers

When you see it

• –During WebDAV operations that recurse infinitely

When you see it

• –Behind a captive portal on public Wi-Fi
• –When a network gateway requires sign-in

When you see it

• –When the origin returns a malformed or empty response to Cloudflare
• –On origin crashes, resets, or protocol violations

Headers to check

When you see it

• –When the origin is offline or refusing connections
• –When the origin firewall blocks Cloudflare IPs

Headers to check

When you see it

• –When the origin is overloaded or unreachable
• –On network issues between Cloudflare and the origin

Headers to check

When you see it

• –When the origin DNS or routing is misconfigured
• –When the origin IP is unreachable from Cloudflare

Headers to check

When you see it

• –When the origin takes longer than 100 seconds to respond
• –On long-running requests behind Cloudflare

Headers to check

When you see it

• –When the origin TLS configuration is invalid or incompatible
• –On certificate or cipher mismatches between Cloudflare and origin

Headers to check

When you see it

• –When the origin certificate is expired, self-signed, or untrusted
• –When Full (strict) SSL mode is enabled and validation fails

Headers to check

When you see it

• –When Cloudflare cannot resolve the origin hostname
• –Often shown alongside a specific 1xxx code in the body

Headers to check

When you see it

• –After exceeding a Cloudflare rate-limiting rule
• –When too many requests come from one IP in a short window

Headers to check