WordPress HTTP Error Codes: Find the Failed Request and Choose the Next Check

An HTTP error appears while you open a page, upload a file or save a post. The number matters, but it only describes how that particular request ended; it does not automatically prove that a WordPress plugin caused the problem.

Pair the status with the failed URL, the action that triggered it and any response message. A 403 on an admin request needs a different investigation from a 500 on the public homepage, even though both may be described simply as a site error.

Use this guide to choose the next check. A firewall, proxy or hosting server may return the response before WordPress handles the request.

Guide reviewed: October 8, 2026. Menu labels use English WordPress; provider-specific controls may differ.

Start with the failed request, not just the error number

Code or group	Start with	Useful next evidence
401 / 403	Authentication versus access refusal	Exact application response or security event
404 / 405	Route versus allowed method	URL and GET/POST method
413 / 431	Request body versus headers	Limit owner and actual request size
429	Service imposing the rate limit	Retry guidance and integration activity
500 / 502 / 503 / 504	Application versus gateway failure	PHP, server and upstream logs

What the two main error families tell you

Codes in the 4xx range describe a problem accepting or fulfilling the request as presented. That does not mean the visitor personally made a mistake. Authentication rules, request limits and security filtering can produce a 4xx response for an otherwise ordinary action.

Codes in the 5xx range describe a failure at a server or gateway. WordPress may be involved, but a stopped upstream service or proxy timeout can produce the response without a theme error. The response body and logs help identify the service responsible.

Common 4xx codes, with a useful first question

Code	Meaning	What to investigate
400	Bad Request	Does the request have the expected format, cookies and body?
401	Unauthorized	Is the expected authentication present and acceptable?
403	Forbidden	Which permission, access policy or security rule refused it?
404	Not Found	Is the URL or endpoint available through the current routing?
405	Method Not Allowed	Does the endpoint accept the method used, such as GET or POST?
406	Not Acceptable	What response formats were requested, and is filtering involved?
408	Request Timeout	Did the server receive the complete request in time?
409	Conflict	Does the operation conflict with the current resource state?
413	Content Too Large	Which service limits the size of the submitted request?
422	Unprocessable Content	Which submitted values or instructions failed application validation?
429	Too Many Requests	Which service enforces the rate limit?
431	Request Header Fields Too Large	Are cookies or other request headers too large?

For example, an upload rejected with 413 may exceed a proxy or web-server limit before WordPress receives it. Disabling an unrelated plugin would not change that limit. A REST request returning 403 may instead need a permissions or firewall investigation.

Common 5xx codes point toward server handling

Code	Meaning	Where evidence is useful
500	Internal Server Error	PHP and server logs, including recent code or configuration changes.
502	Bad Gateway	The gateway’s upstream connection and response.
503	Service Unavailable	Maintenance, overload and unavailable application resources.
504	Gateway Timeout	The upstream operation that did not finish in time.
507	Insufficient Storage	Storage required by the responding service.

Some hosts display 508 with a “resource limit reached” message. That is hosting-specific usage; the standardized 508 meaning is Loop Detected. The provider’s full message and account resource data are more useful than assuming the number has one universal hosting meaning.

A failed request is more informative than a screenshot of the headline

Open Developer Tools → Network.
Perform the failing action once with safe test details.
Select the request for that action, not an unrelated missing image.
Record URL, method, status, response type and time.
Compare the response with the applicable server or security log.

The browser’s Network panel shows the URL, method, status, response headers and response body. For a form, editor or upload failure, select the request triggered by that action rather than an unrelated missing asset.

Keep the approximate time and the change that preceded the failure. A branded firewall page suggests a different path from a PHP fatal error. Request data can contain private information, so remove credentials, cookies and submitted personal data before sharing a report.

Similar numbers can describe different situations

Example: a large upload gets 413 before PHP receives it. Check the proxy/web-server body-size limit named by the response. A 431 instead concerns headers, often including cookies; reducing the uploaded picture may not address that failure.

A 401 concerns missing or unacceptable authentication, while a 403 is a refusal to fulfill the request. The exact application may add further detail. Re-entering a password will not necessarily repair a firewall refusal.

A 408 concerns receiving the request in time. A 504 concerns a gateway waiting for an upstream response. A slow upload and a slow database query can therefore require different investigations even though both feel like a timeout.

For 429, look for the service imposing the limit and any Retry-After guidance. Repeated retries may prolong or worsen the problem. A limit from an external API also needs attention in the integration using that API, rather than a theme change.

Following the evidence into WordPress

Follow the named component only after the response or log points there. If changing one component on staging makes the same request succeed, restore it and confirm the comparison. Keep authentication and access rules intact except for a documented correction to the specific failed request.

When a response or log points toward PHP or WordPress, investigate the named operation, plugin or theme. Diagnostic logging can help, but errors should not be displayed to visitors. A backup or test environment is useful before changing configuration or comparing plugin behavior.

After a correction, repeat the original action and inspect its response. A working home page does not prove a checkout or authenticated editor request has recovered. The most helpful record names the failed request, the responding service and the change that restored the intended result.

HTTP references and focused WordPress guides

Open a focused guide

After the correction, test the original action and confirm its output. A working homepage does not prove that an authenticated save or checkout request works.