Blog

Articles, guides, and insights about HTTP status codes and web development

·7 min read

Understanding Cloudflare 525 SSL Handshake Failed: When Cloudflare and Your Origin Can't Agree on TLS

What Cloudflare's 525 SSL Handshake Failed means — the TLS negotiation between Cloudflare and your origin broke down before any HTTP request happened — the conditions that trigger it, and how to fix an origin's SSL setup.Cloudflare
·8 min read

Understanding Cloudflare 524 A Timeout Occurred: When Your Origin Connects but Never Answers

What Cloudflare's 524 A Timeout Occurred really means — the origin accepted the connection but never sent a response in time — how it differs from 522 and 504, and how to fix or work around the timeout.Cloudflare
·7 min read

Understanding Cloudflare 523 Origin Is Unreachable: When There's No Route to Your Server

What Cloudflare's 523 status code means — a network-level routing failure that means Cloudflare can't even reach your origin's IP address — including the specific AWS VPC route table trap Cloudflare documents, and how it differs from 521 and 522.Cloudflare
·8 min read

Understanding Cloudflare 522 Connection Timed Out: The TCP Handshake That Never Finished

What Cloudflare's 522 status code means — the origin never completed the TCP handshake or acknowledged the request in time — the exact timeout windows Cloudflare documents, and how it differs from 524 and standard 504 Gateway Timeout.Cloudflare
·7 min read

Understanding Cloudflare 521 Web Server Is Down: When Your Origin Refuses the Connection

What Cloudflare's 521 status code means — the origin actively refused Cloudflare's TCP connection — the two most common causes (a stopped server or a blocked firewall), and how to check Cloudflare's published IP ranges against your own rules.Cloudflare
·8 min read

Understanding Cloudflare 520 Web Server Returns Unknown Error: The Catch-All Origin Failure

What Cloudflare's 520 status code actually means — the origin sent back something Cloudflare couldn't parse — plus the real causes (oversized headers, malformed responses, PHP crashes) and how to find the raw origin behavior underneath it.Cloudflare
·7 min read

Understanding HTTP 511 Network Authentication Required: The Captive Portal Code

What HTTP 511 Network Authentication Required actually means, why it exists specifically for Wi-Fi captive portals, why the RFC says origin servers must not generate it, and why it isn't just 401 in disguise.5xxServer Error
·8 min read

Understanding HTTP 426 Upgrade Required: The Server's Demand, Not Its Agreement

What HTTP 426 Upgrade Required actually promises, its mandatory Upgrade header, how it's the mirror image of 101 Switching Protocols, and the mostly-obsolete history of using it to force TLS.4xxClient Error
·8 min read

Understanding HTTP 101 Switching Protocols: How the WebSocket Handshake Actually Works

What HTTP 101 Switching Protocols really promises, why it's the response code behind every WebSocket connection, and why HTTP/2 and HTTP/3 don't use it at all.1xxInformational
·8 min read

Understanding HTTP 100 Continue: The Handshake Before the Upload

How HTTP 100 Continue lets a client check whether it's worth sending a large request body before it sends it — the Expect: 100-continue negotiation, why curl uses it automatically, and what happens when a server ignores it.1xxInformational
·8 min read

Understanding HTTP 415 Unsupported Media Type: Content-Type, Not Content Correctness

What 415 Unsupported Media Type really means, why it's about format and Content-Type rather than field validation, how it contrasts with 400 and 406, and why Express doesn't reject a wrong Content-Type with 415 unless you tell it to.4xxClient Error
·9 min read

Understanding HTTP 413 Payload Too Large: Upload Limits, NGINX, and the RFC 9110 Rename

What 413 Payload Too Large (now Content Too Large in RFC 9110) really means, where NGINX and Express upload limits actually live, and how to configure and return it correctly without one silently overriding the other.4xxClient Error
·8 min read

Understanding HTTP 408 Request Timeout: Who's Actually Too Slow, and Why It Isn't 504

What 408 Request Timeout really means (the client was too slow sending the request, not the server too slow responding), how it differs from 504 Gateway Timeout and NGINX's 499, and how to return and handle it correctly.4xxClient Error
·8 min read

Understanding HTTP 303 See Other: The Redirect That Always Switches to GET

What 303 See Other really means, why it's the only redirect code that guarantees a switch to GET, how the Post/Redirect/Get pattern uses it to stop duplicate form submissions, and when to reach for 303 instead of 307.3xxRedirection
·8 min read

Understanding HTTP 451 Unavailable For Legal Reasons: The Transparency Code for Censorship, and Why It Isn't 403

What 451 Unavailable For Legal Reasons really means, the Fahrenheit 451 naming story behind it, how the Link: rel="blocked-by" header works, and why it exists precisely to be distinguishable from an ordinary 403.4xxClient Error
·8 min read

Understanding HTTP 418 I'm a Teapot: The April Fools' Code That Refused to Die

The real story behind 418 I'm a Teapot — its origin in the 1998 HTCPCP April Fools' RFC, the 2017 campaign that saved it from deletion, why RFC 9110 lists it as reserved-but-undefined, and why you shouldn't use it for real errors.4xxClient Error
·8 min read

Understanding HTTP 206 Partial Content: Range Requests, Resumable Downloads, and Video Seeking

How 206 Partial Content and the Range/Content-Range/Accept-Ranges headers work together, how multipart/byteranges responses cover multiple ranges in one reply, and why it's not the same thing as chunked transfer encoding.2xxSuccess
·7 min read

Understanding HTTP 202 Accepted: The Async Contract That Promises Less Than You Think

What 202 Accepted actually guarantees — and doesn't — for async work, how to design status-polling and Location-header patterns around it, and how it differs from 200, 201, and 204.2xxSuccess
·9 min read

Understanding HTTP 409 Conflict: State Conflicts, Optimistic Locking, and Why It Isn't a Validation Error

What 409 Conflict really means, why it's the wrong code for basic validation failures, how optimistic locking and duplicate-resource conflicts trigger it, and how to return it correctly across Express, Next.js, and NGINX.4xxClient Error
·8 min read

Understanding HTTP 405 Method Not Allowed: The Required Allow Header and Why It's Not a 404

What 405 Method Not Allowed really means, why the Allow header is mandatory rather than optional, how it differs from 404 and 501, and how to return it correctly across Express, Next.js, and NGINX.4xxClient Error
·10 min read

Understanding HTTP 307 Temporary Redirect: The Method-Preserving Fix for 302, and Why Next.js Defaults to It

What 307 Temporary Redirect really means, why it guarantees the HTTP method survives a redirect where 302 doesn't, how it compares to 301, 302, and 308, and how to return it correctly across Express and Next.js.3xxRedirection
·10 min read

Understanding HTTP 410 Gone: The Deliberate Tombstone, and Why It Beats 404 for Deletions

What 410 Gone really means, why it's a stronger signal than 404 for permanently deleted content, how the 'don't guess' rule in the RFC works, and how to return it correctly across Express, Next.js, and NGINX.4xxClient Error
·8 min read

Understanding HTTP 304 Not Modified: Conditional Requests, ETags, and Why It's a Success

What 304 Not Modified really means, how conditional GET with ETag and If-Modified-Since works, why 304 isn't an error, and how to return it correctly from Express and NGINX.3xxRedirection
·7 min read

Understanding HTTP 204 No Content: Why It's Not 200 With an Empty Body

What 204 No Content really means, why it's semantically different from a 200 with an empty body, how it compares to 200, 201, 202, and 205, and how to return it correctly from Express and Next.js.2xxSuccess
·10 min read

Understanding HTTP 201 Created: The Location Header and Doing Creation Right

What 201 Created really promises (a new resource exists, and here's where), why the Location header matters, how 201 interacts with POST vs PUT idempotency, and when to reach for 200, 202, or 204 instead.2xxSuccess
·12 min read

Understanding HTTP 422 Unprocessable Entity: Validation Errors Done Right

What 422 really means (valid syntax, invalid meaning), how to draw the line between 400 and 422, why RFC 9110 renamed it Unprocessable Content, and how to return useful validation errors from Express, Next.js, and REST APIs.4xxClient Error
·13 min read

Understanding HTTP 504 Gateway Timeout: Who Gave Up Waiting, and Why

What 504 Gateway Timeout really means (a proxy gave up on its upstream), how it differs from 502, 503, 408, and Cloudflare's 524, why your app usually shouldn't return it, and how to align timeouts so you stop seeing it.5xxServer Error
·12 min read

Understanding HTTP 302 Found: Temporary Redirects, the POST-to-GET Trap, and When to Use 307 Instead

What 302 Found really means, why it can silently turn POST into GET, how it differs from 301, 303, 307, and 308, and why it's the accidental default redirect in most frameworks.3xxRedirection
·11 min read

Understanding HTTP 400 Bad Request: Malformed Syntax, the 400 vs 422 Line, and When Generic Is Correct

What 400 Bad Request actually covers (syntax errors, not validation errors), how to draw the line between 400 and 422, why browsers show 400 for oversized cookies, and how to return it with an error body clients can act on.4xxClient Error
·11 min read

Understanding HTTP 403 Forbidden: Authorization, the 401 vs 403 Trap, and When to Hide a Resource Entirely

What 403 Forbidden really means (authorization, not authentication), why logging in won't fix it, how it differs from 401, 404, and 407, and how to return and handle it correctly across Express, Next.js, NGINX, and Apache.4xxClient Error
·8 min read

Understanding HTTP 308 Permanent Redirect: Method-Preserving Redirects Done Right

How 308 Permanent Redirect differs from 301, why it preserves the HTTP method, the full 301/302/303/307/308 matrix, framework gotchas (including Next.js), caching, and SEO.3xxRedirection
·9 min read

Understanding HTTP 401 Unauthorized: Authentication, WWW-Authenticate, and the 401 vs 403 Trap

What 401 Unauthorized really means (authentication, not authorization), why the WWW-Authenticate header is mandatory, when to use 401 vs 403 vs 407, and how to return and handle it correctly.4xxClient Error
·10 min read

Understanding HTTP 404 Not Found: Why It Happens and What to Do About It

The internet's most famous error explained — what 404 really means, when to use it vs. 410 or 403, how it affects SEO, and how to build a 404 page that doesn't lose users.4xxClient Error
·10 min read

Understanding HTTP 503 Service Unavailable: Planned Downtime, Overload, and Graceful Failure

A deep dive into HTTP 503 — when to return it, why Retry-After matters, how to ship maintenance windows without trashing your SEO, and the differences between 503, 500, 502, and 429.5xxServer Error
·8 min read

Understanding HTTP 103 Early Hints: Faster Pages with Smarter Preloads

How HTTP 103 Early Hints lets the server tell the browser what to preload before the real response is ready — what it does, when it helps, and how to ship it.1xxInformational
·10 min read

Understanding NGINX 499 Client Closed Request: When Your Users Give Up First

A deep dive into NGINX's 499 status code — what it means when the client hangs up before the server can respond, and how to use it as a leading indicator of problems.NGINX
·7 min read

Understanding HTTP 301 Redirects: SEO, Migrations, and Common Pitfalls

A comprehensive guide to HTTP 301 Moved Permanently — when to use it, how it affects SEO, implementation examples, and mistakes that can tank your rankings.3xxRedirection
·8 min read

Understanding 429 Too Many Requests: Rate Limiting Done Right

A deep dive into HTTP 429 Too Many Requests — why rate limiting matters, how to implement it on the server, and how to handle it gracefully as a client.4xxClient Error
·5 min read

Understanding HTTP 200 OK: The Success Status Code Explained

A comprehensive guide to the HTTP 200 OK status code — what it means, how it varies by HTTP method, common pitfalls, and best practices for API design.2xxSuccess
·7 min read

Understanding 500 Internal Server Error: Causes, Debugging, and Prevention

A deep dive into HTTP 500 Internal Server Error — what triggers it, how to debug it, and strategies to prevent unhandled server failures in production.5xxServer Error
·4 min read

Understanding 502 Bad Gateway Errors: Causes, Fixes, and Prevention

A deep dive into HTTP 502 Bad Gateway errors — what causes them, how to diagnose them, and proven strategies to prevent them in production.5xxServer Error