Reference
HTTP 5xx server error status codes
A 5xx status says the server is aware it failed to answer a request that may have been valid. RFC 9110 defines six of these codes — 500 to 505 — and five more are registered by other specifications, of which 511 is the one a website visitor may meet on a captive network. Four of them are the everyday signals of an unhealthy site: 500 for an application error, 502 and 504 for a failure behind a proxy, and 503 for a service that is unavailable or deliberately paused.
| Code | Reason phrase | Meaning | Defined in | In a scan |
|---|---|---|---|---|
| 500 | Internal Server Error | The server met an unexpected condition that prevented it from fulfilling the request. | RFC 9110 | Retried after a bounded wait; if it persists, the page is reported as a server error. |
| 501 | Not Implemented | The server does not support the functionality required, for example an unknown method. Heuristically cacheable. | RFC 9110 | The link check repeats a HEAD answered 501 with GET, then judges the GET. |
| 502 | Bad Gateway | A gateway or proxy received an invalid response from the server behind it. | RFC 9110 | Retried after a bounded wait; if it persists, the page is reported as a server error. |
| 503 | Service Unavailable | The server is temporarily unable to handle the request, from overload or scheduled maintenance; Retry-After may say for how long. | RFC 9110 | Retried after a bounded wait; a lasting 503 is also examined for maintenance wording. |
| 504 | Gateway Timeout | A gateway or proxy did not receive a timely response from the server behind it. | RFC 9110 | Retried after a bounded wait; if it persists, the page is reported as a server error. |
| 505 | HTTP Version Not Supported | The server does not support the major HTTP version of the request. | RFC 9110 | Reported as a server error. |
| 506 | Variant Also Negotiates | A configuration error in transparent content negotiation: the chosen variant is itself configured to negotiate. | RFC 2295 | Reported as a server error. |
| 507 | Insufficient Storage | The server cannot store the representation needed to complete the request. | RFC 4918 (WebDAV) | Reported as a server error. |
| 508 | Loop Detected | The server found an infinite loop while processing the request. | RFC 5842 (WebDAV) | Reported as a server error. |
| 510 | Not Extended | The request did not meet the policy for accessing the resource under the HTTP Extension Framework. | RFC 2774 (experimental) | Reported as a server error. |
| 511 | Network Authentication Required | The client must authenticate to gain network access; sent by captive portals, not by the site itself. | RFC 6585 | Reported as a server error. |
Reading the four common codes
500 is the application's own failure: an exception, a missing configuration value, a database that refused a query. The detail is in the application log, never in the response, and a response that shows a stack trace to visitors is a second problem on top of the first.
502 and 504 come from something in front of the application — a reverse proxy, a load balancer, a CDN. 502 means it got an answer it could not use; 504 means it got no answer in time. Both point at the application or the link to it, not at the proxy that reports them.
503 is the code for a server that is temporarily unable to serve: overloaded, restarting, or paused on purpose. It is also the right code for a planned maintenance page, sent with Retry-After, because it tells clients and crawlers that the condition is temporary.
How a scan retries, classifies and reports a server error
500, 502, 503 and 504 are treated as possibly transient. By default a URL gets up to three attempts, with a backoff that honours Retry-After but never waits more than four seconds between them, so a brief failure during a deployment does not become a finding.
When the error lasts, `availability.error_pages` fails and lists every crawled page that answered with a status of 500 or above. A link whose final status is 500 or above counts as broken.
The entry page is classified on its own by `availability.status_classification`. A 5xx there is reported as a server error, with critical impact — a state distinct from a DNS failure, a TLS failure, a timeout or a redirect loop, because each of those has a different fix.
A 503 on the entry page is examined further by `availability.maintenance_page`. With maintenance wording it is reported as a maintenance page; without it, as a service-unavailable response that is not necessarily maintenance. The scan does not guess which one the site meant.
A 403 or 503 served by a CDN challenge page is a different thing: it is classified as a protection the crawler met, recorded as such, and never bypassed.
The registered codes rarely seen on websites
505, 506, 507, 508 and 510 belong to protocol version negotiation, transparent content negotiation, WebDAV and an experimental extension framework. A public website serving one of them on an ordinary page is usually exposing a misconfigured component rather than using the code as designed.
511 is sent by a network, not by a website: it is how a captive portal on public Wi-Fi asks a device to sign in before it gets access. A scan running from a data centre does not meet it.
Frequently asked questions
- What status should a maintenance page return?
- 503 Service Unavailable, ideally with a Retry-After header. It tells browsers, crawlers and monitors that the condition is temporary. A maintenance page answered with 200 tells them the page's normal content has been replaced by the maintenance message.
- Is a 502 the fault of the proxy or of the server behind it?
- Almost always of the server behind it, or of the connection to it: the proxy received an answer it could not use and reports that. The application logs and the upstream health are where to look first.
- Why did a scan not report a server error my visitors saw?
- Server errors are often intermittent, and a scan retries 500, 502, 503 and 504 before reporting them, from a single location, at a single moment. A failure that lasted seconds, or that only happens in one region, can be absent from the snapshot.
Sources
Related
VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.
Scan a website