418 I'm a teapot

What 418 means

Defined in the Hyper Text Coffee Pot Control Protocol as an April Fools' RFC. It has no meaning in real HTTP, yet many frameworks implement it and some sites return it to bots or as a playful block page.

If you see 418 from a production service, treat it like a 403: something decided your request should not be served.

Common causes

• A deliberate Easter egg.
• A bot-protection rule that returns 418 to scrapers.

How to fix it

• Do not rely on it in APIs; use 403 or 429 with a clear message.

What it looks like

A typical response:

HTTP/1.1 418 I'm a teapot

The same event in an nginx access log (the status is the number after the request line):

203.0.113.7 - - [10/Sep/2026:10:12:01 +0000] "GET /api/orders HTTP/1.1" 418 153 "-" "Mozilla/5.0"

Check it with curl

-i prints the status line and headers, and -w '%{http_code}' prints only the number, which is handy in scripts and health checks. Replace the URL with yours:

curl -sS -o /dev/null -w '%{http_code} %{time_total}s\n' https://example.com/api/orders

Compare what curl sees with what the browser sees. A different status from the same URL usually means a cache, a CDN edge or a cookie is in the way.

Investigating a run of 418s? Paste the log excerpt into Log Share to get line numbers, highlighting and an expiring link for whoever is on call with you.

Related status codes

• 403Forbidden: The server understood the request and refuses to authorise it.
• 429Too Many Requests: The client has sent too many requests in a given amount of time.

FAQ