511 Network Authentication Required
The client must authenticate to gain network access. This is the captive portal code, sent by the network rather than by the site you asked for.
At a glance
- Status code
- 511 Network Authentication Required
- Class
- 5xx, server error, the request looked fine and the server failed
- Defined in
- RFC 6585
- Cacheable by default
- no
- Response body
- Should contain a link to the login page.
In detail
A hotel or airport network intercepts traffic until you accept its terms. 511 exists so that interception is honest instead of silently returning someone else's login page under a 200.
It must be sent by the intercepting device, never by an origin server. An origin has no view of network-level access.
The body should link to the portal. Clients that detect captive portals do so by requesting a known URL and checking whether the answer is what they expected.
Examples
HTTP/1.1 511 Network Authentication Required
Content-Type: text/html
<meta http-equiv="refresh" content="0; url=https://portal.example/login">Things that catch people out
- Most captive portals return 302 to their portal instead of 511, which is exactly the ambiguity 511 was designed to remove.
- Because interception happens below TLS, a portal cannot inject 511 into an HTTPS request without a certificate error, so the code mostly appears on plain HTTP probes.
Try it: HTTP Request Builder
Build a request with any method, headers and body, send it, and read the status line the server returns.
HTTP Request Builder
LOCAL · Browser-OnlyBuild and test HTTP requests with custom headers and body
Authentication
Headers
Generate Code
curl -X GET 'https://api.example.com/endpoint' \
-H 'Content-Type: application/json'Showing a sample URL. Enter your endpoint above to update the snippet.
Related HTTP status codes
All http status codes →401 Unauthorized
The request lacks valid credentials. Despite the name, this is about authentication (who you are), not authorisation (what you may do).
407 Proxy Authentication Required
A proxy between the client and the server needs credentials. This is 401 raised by the intermediary rather than by the origin.
302 Found
The resource is temporarily at a different URL. The original URL stays authoritative and should keep being used for future requests.
100 Continue
The server has read the request headers, is willing to accept the body, and the client should now send it.
101 Switching Protocols
The server agrees to change protocol on this connection, which in practice almost always means upgrading to WebSocket.
102 Processing
A WebDAV interim response meaning the request was received and is still being worked on, sent to stop the client timing out.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL