What a 404 means, when to send it, and when 410 or 403 is the better answer
Runs in your browser. Nothing you type is sent anywhere. Updated on 25 Oct 2026.A 404 says nothing lives at this address and refuses to say whether anything ever did. It is the right answer for a wrong URL, a deleted row or a typo in a path parameter. It is the wrong answer for a page that moved, which needs a 301, and for content you removed on purpose, which search engines drop faster when you send 410 instead. Caches may store a 404 with no cache headers at all.
Open the page with 404 Not Found already selected in the Codes list.
Read "When to use it" for the usual causes: a wrong URL, a deleted record or a typo in a path parameter.
Search for 301 or 410 to compare them, for a page that moved or content removed on purpose.
Read the note on caching, and add Cache-Control if a missing page may come back later.
Choose your framework under "Send this code in" and press Copy snippet.
This HTTP status codes reference lists every registered code from 100 to 511, plus the unregistered ones that nginx, Apache, Laravel and Cloudflare return. Each entry says what the code actually means, when to send it, whether a cache may store the response without cache headers, whether a redirect changes the request method, and which RFC defines it.
Search works three ways. Type a number such as 404, or a class such as 4xx, to jump straight to it. Type a name such as "not found". Or describe what you want to express, and the intent search finds the code: "login failed" gives 401, "rate limit" gives 429, "file too large" gives 413, "validation failed" gives 422.
Two details most lists get wrong are included here. Cacheability is not a yes or no: RFC 9110 section 15.1 names twelve codes a cache may store with no explicit headers at all, which is why an accidental 404 can stick. And redirects differ: 301 and 302 let a client turn a POST into a GET, 303 always does, while 307 and 308 must repeat the method and body exactly.
The rest of the article, and all 6 questions about HTTP Status Codes, are on the HTTP Status Codes page.
Use 401 Unauthorized. It means the server does not know who you are, so a missing, expired or wrong credential belongs there. Use 403 Forbidden only when you know who the caller is and are still refusing. The specification wants a WWW-Authenticate header on every 401.
401 means unauthenticated: send credentials and try again. 403 means authenticated but not allowed: better credentials will not help. If revealing that a record exists is itself a leak, some APIs answer 404 instead of 403 so an attacker learns nothing.
RFC 9110 section 15.1 lists 200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414 and 501 as heuristically cacheable, and RFC 7725 adds 451. A cache may store those with no Cache-Control or Expires header, which is why a temporary 404 can persist. Every other code needs explicit cache headers.
418 I'm a Teapot comes from RFC 2324, an April Fools' joke from 1998 about a coffee pot protocol. A 2017 proposal to reuse the number was withdrawn after objections, so it stays reserved in the IANA registry and must never be used for a real meaning.
Still stuck? Ask about HTTP Status Codes and anybody who knows can answer. No account needed.
Same job, other tools: Luhn Algorithm Checker – Run the Luhn mod 10 check on any number and see every doubled digit and the total · Link Preview Checker – Find the missing tag behind a WhatsApp or Slack link with no picture.
On the related tools: Hadolint Online – Run hadolint rules on a Dockerfile in your browser, with no install and no Docker.
In the collection Debug and Inspect.