Why a server returns 503, why it is the right code for maintenance, and how to fix it
Runs in your browser. Nothing you type is sent anywhere. Updated on 25 Oct 2026.A 503 says the server is running but cannot handle the request right now: it is overloaded, restarting after a deploy, or switched to maintenance. RFC 9110 section 15.6.4 defines it as temporary and lets the server send Retry-After. It is the right code for a planned maintenance page, because search engines keep the page indexed and come back later, which a maintenance page sent with 200 does not get.
Open the page with 503 Service Unavailable already selected.
Read "When to use it": overload, a restart or planned maintenance, all temporary.
On your own server, check whether the application is restarting, out of workers or in maintenance mode.
Choose your framework under "Send this code in" and press Copy snippet for a 503 with Retry-After.
This HTTP status codes reference lists every registered code from 100 to 511, plus the unregistered ones that nginx, Apache, Laravel and Cloudflare return. Each entry says what the code actually means, when to send it, whether a cache may store the response without cache headers, whether a redirect changes the request method, and which RFC defines it.
Two details most lists get wrong are included here. Cacheability is not a yes or no: RFC 9110 section 15.1 names twelve codes a cache may store with no explicit headers at all, which is why an accidental 404 can stick. And redirects differ: 301 and 302 let a client turn a POST into a GET, 303 always does, while 307 and 308 must repeat the method and body exactly.
Every common code comes with a copyable snippet for raw HTTP, Express, Fastify, FastAPI, Go and PHP, including the header that code requires, such as WWW-Authenticate on a 401 or Allow on a 405. Nothing is sent anywhere; the whole table is in the page.
The rest of the article, and all 6 questions about HTTP Status Codes, are on the HTTP Status Codes page.
Use 401 Unauthorized. It means the server does not know who you are, so a missing, expired or wrong credential belongs there. Use 403 Forbidden only when you know who the caller is and are still refusing. The specification wants a WWW-Authenticate header on every 401.
RFC 9110 section 15.1 lists 200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414 and 501 as heuristically cacheable, and RFC 7725 adds 451. A cache may store those with no Cache-Control or Expires header, which is why a temporary 404 can persist. Every other code needs explicit cache headers.
418 I'm a Teapot comes from RFC 2324, an April Fools' joke from 1998 about a coffee pot protocol. A 2017 proposal to reuse the number was withdrawn after objections, so it stays reserved in the IANA registry and must never be used for a real meaning.
No. 499 is an nginx log-only code for a client that hung up, and 520 to 527 are Cloudflare codes for problems between the edge and your origin. None are registered with IANA. They are listed here because you will meet them in logs, each marked with the product that invented it.
Still stuck? Ask about HTTP Status Codes and anybody who knows can answer. No account needed.
Same job, other tools: Luhn Algorithm Checker – Run the Luhn mod 10 check on any number and see every doubled digit and the total · Razorpay Test Cards – Razorpay test mode card numbers: Visa, Mastercard, RuPay, Amex, Diners, and error cards.
On the related tools: Hadolint Online – Run hadolint rules on a Dockerfile in your browser, with no install and no Docker.
In the collection Debug and Inspect.