HTTP 404 Not Found – Free, Online, Private

What HTTP 404 means

404 says the origin server did not find a current representation for the target resource, or it is not willing to disclose that one exists. The request was understood. The path may be wrong, the object may have been deleted, or the server may be hiding it. 404 is not a temporary outage. A client that retries immediately will get 404 again.

404 Not Found belongs to the 4xx client error class. Clients that only look at the class will group it with its neighbors. Clients that care about the exact code should use the narrower rule on this page, because the class is only the first digit.

When you see HTTP 404

When you see HTTP 404 Not Found, stop on that exact status line. 404 Not Found means the server found no current representation for the target. The trace that usually produces it: The path is wrong or the id was never issued. The 4xx client error class only tells you the first digit. A neighbor in that class is a different fault, and the fix on this page does not transfer to it.

Return 404 when the URL does not map to a resource you are willing to admit. Use 410 if the resource existed and is gone on purpose and you want clients to drop their links. Use 403 or 404 consistently when authorization and existence would otherwise be distinguishable. Do not return 404 for a malformed query. That is 400.

How to fix HTTP 404

To fix HTTP 404, change the condition that made the server choose Not Found. Stop, unless you have a reason to believe the URL will appear. Do not retry a 404 on a timer. Check the URL. If a person typed it, show a not-found page rather than an error toast that says 'try again'. Retrying the same URL will not create the resource. Retry only if you are waiting for a specific race you documented, and back off. If the log line is a different code, leave this page. The mix-up people make with 404 is this one: 410 means gone on purpose. 204 means the request succeeded and there is no body. 500 means the server failed while looking. 404 means the lookup worked and the answer is no.

• The object was deleted and the URL was not given a 410.
• A single-page app returned 200 for every path, so the real 404 never happened and broken links looked valid.
• A client treated 404 as transient and retried a typo for hours.

An access log that only stores 404 is not enough to tell these apart. Keep the method, the path, and a request id. Do not keep the Authorization header or a request body that might be a token. The status explains the outcome. It is not a place to echo secrets back to the client either.

Example response

HTTP 404 Not FoundHTTP/1.1 404 Not Found
Content-Type: text/plain

Not found

A short body is enough for an API. A website should return an HTML page a person can use, with the same 404 status. Returning the homepage with 200 for a missing URL teaches caches and search engines that the missing URL is a copy of the homepage.

What the client should do

Stop, unless you have a reason to believe the URL will appear. Do not retry a 404 on a timer. Check the URL. If a person typed it, show a not-found page rather than an error toast that says 'try again'.

404 may be cached. A short max-age keeps a newly created resource from staying invisible. An infinite 404 cache is how a resource stays missing after you create it.

Retrying the same URL will not create the resource. Retry only if you are waiting for a specific race you documented, and back off.

Codes people confuse with HTTP 404

410 means gone on purpose. 204 means the request succeeded and there is no body. 500 means the server failed while looking. 404 means the lookup worked and the answer is no.