HTTP status codes and Cloudflare errors: what 403, 404, 429, 500, 503 and 521 mean

Updated: 12 October 2026

Every answer from a web server starts with a three-digit status code. Browsers usually hide it when all is well and show an error page when it is not. The code says a lot about what is going on: whether the site is up, whether it refused the request, or whether the server itself is in trouble. This guide covers the codes you are most likely to meet, as defined in RFC 9110, the HTTP standard, plus the codes Cloudflare adds for sites behind it.

The five classes

The first digit gives the class, and the class alone already answers the question “is the site up?”.

Codes	Class	Is the site up?
`100–199`	Informational: the request was received and is being processed	Yes. Browsers handle these without showing them.
`200–299`	Success: the request worked	Yes.
`300–399`	Redirection: the page is at another address	Yes, as long as the redirects end on a page.
`400–499`	Client error: the request was refused or cannot be met	Yes. The server answered, but not with the page.
`500–599`	Server error: the server failed to answer properly	Not usable. The server or something behind it has a problem.

Success and redirects

200 OKThe normal answer: here is the page.
301 Moved PermanentlyThe page has moved for good. Browsers and search engines remember the new address.
302 Found and 307 Temporary RedirectThe page is temporarily at another address. 307 keeps the request method, so a form sent with POST is sent again with POST.
308 Permanent RedirectLike 301, but the request method is kept.
304 Not ModifiedThe copy the browser already has is still current, so the server sends no new copy.

Redirects become a problem when they never end. If address A sends to B and B sends back to A, the browser gives up with an error such as ERR_TOO_MANY_REDIRECTS. A common cause is a site set to force https while a proxy in front of it talks to the server over http, or the other way round.

Client errors: the server answered, but refused

400 Bad RequestThe server could not understand the request, for example a malformed address or an oversized cookie.
401 UnauthorizedYou need to log in. The site works; the page is not public.
403 ForbiddenThe server understood the request and refuses it. It may be a page without public access, or a firewall that blocks some visitors, networks or countries.
404 Not FoundThere is nothing at this address. The site is up, but the link is wrong or the page was removed.
410 GoneLike 404, but the page was removed on purpose and is not expected to come back.
429 Too Many RequestsToo many requests in a short time, so the server asks you to slow down. It may say how long to wait with a Retry-After header. Defined in RFC 6585.
451 Unavailable For Legal ReasonsThe page is blocked because of a legal demand, such as a court order. Defined in RFC 7725.

All of these show that something is answering for the site, although behind a content delivery network such as Cloudflare the answer may come from the network rather than from the site’s own server. For a status checker, 403 and 429 are especially common: many sites refuse automatic requests from data centres while serving people normally.

Server errors: the site has a problem

500 Internal Server ErrorSomething went wrong inside the site, often a bug or a failed database connection. The server’s error log says what.
502 Bad GatewayA server acting as a gateway or proxy got an invalid answer from the server behind it.
503 Service UnavailableThe server cannot handle the request right now, because it is overloaded or in maintenance. It may say when to try again with Retry-After.
504 Gateway TimeoutA gateway or proxy waited too long for the server behind it.

Many sites sit behind a proxy, a load balancer or a content delivery network, so 502 and 504 often mean that this front part works while the application behind it does not.

Cloudflare’s own codes

Cloudflare sits between visitors and many websites’ own servers, called the origin. When the origin fails, Cloudflare answers with a code of its own and an error page that says whether the problem is in the browser, at Cloudflare or at the host. These are the ones Cloudflare documents:

Code	What it means
`520`	The origin returned an empty, unknown or unexpected answer.
`521`	The origin refused the connection from Cloudflare, usually because the web server is off or a firewall blocks Cloudflare.
`522`	Cloudflare timed out connecting to the origin: no reply to the connection within 19 seconds, or no acknowledgement of the request within 90 seconds.
`523`	Cloudflare cannot reach the origin, usually because no network route leads to its IP address.
`524`	Cloudflare connected, but the origin did not send an HTTP answer within the 125-second default timeout.
`525`	The secure (SSL/TLS) handshake between Cloudflare and the origin failed.
`526`	Cloudflare could not validate the origin’s SSL certificate.
`530`	Cloudflare cannot resolve the origin’s host name. The page also shows a 1xxx error with more detail.

In all of these, Cloudflare is working and the problem is at the site’s own server, so only its owner or host can fix it. Cloudflare can also answer with a bot check instead of the page. That answer means the site is protected, not down, and Cloudflare marks it with a cf-mitigated: challenge header that checkers can recognise.

Which codes mean a site is down

2xx and 3xx: the site is up.
401, 403, 404, 410, 429 and 451: the site is up but did not give you this page. Check the address, log in, wait, or try from another network.
500 to 599: the server answered but cannot serve pages, so for visitors the site is down. Wait and retry; if it is your site, check the error log and the services behind the proxy.
520 to 526 and 530 from Cloudflare: the site’s own server is down or unreachable. Cloudflare is fine.
No code at all, because DNS or the connection failed: the site cannot be reached. The previous guide in this series shows how to find which layer failed.

Is it down?

Frequently asked questions

Is a 404 error my fault?

Usually not. The site works but has nothing at that address, because the link is old or mistyped or the page was removed. Check the address, or start from the home page.

What is the difference between 502, 503 and 504?

502 means a gateway got an invalid answer from the server behind it, 503 that the server cannot take requests right now, often because of overload or maintenance, and 504 that the gateway waited too long for an answer.

Why does a site show 403 to a checker but open in my browser?

Many sites block automatic requests from data centres, or ask for a bot check that only a real browser can pass. The 403 shows that something is answering for the site; behind a CDN such as Cloudflare it may come from the CDN rather than the site’s own server.

Is error 521 Cloudflare’s fault?

No. It means the site’s own server refused the connection from Cloudflare. Cloudflare is working; the owner or host has to bring the server back or let Cloudflare’s addresses through the firewall.

Previous in the series ← Is a website down, or is it just you? How to check, step by step