Why do I see 511 on public Wi-Fi?
The network requires you to sign in or accept terms before allowing internet access. Open any http page in a browser to reach the login portal.
HTTP 511 NETWORK AUTHENTICATION REQUIRED
A captive portal, such as hotel Wi-Fi, needs you to log in first. 511 belongs to the 5xx server error class and is defined in RFC 6585.
Loading the workbench.
About HTTP 511
What Does HTTP 511 Network Authentication Required Mean?
A captive portal, such as hotel Wi-Fi, needs you to log in first. The code is registered with IANA and defined in RFC 6585.
Server error: the server failed to fulfill a valid request. Every code from 500 to 599 shares that general meaning, so a client that does not recognise 511 must treat it like 500.
When Do You See a 511 Response?
511 Network Authentication Required, from RFC 6585, is meant for captive portals: hotel, airport, or cafe Wi-Fi that intercepts traffic until you log in or accept terms. Instead of silently returning the portal page with a 200, which can confuse apps and pollute caches, the network answers 511 and includes a link to the login page. Origin servers never send it; it comes from the network in between.
How Do You Fix a 511?
Users should open a browser and complete the network's login or terms page; operating systems usually detect captive portals and prompt automatically. Apps should not cache or parse the body as API content. Network operators should return 511 with a body containing a link or meta refresh to the portal and must not let caches store it. HTTPS sites will typically show a certificate error instead of a 511.
What Does a 511 Response Look Like?
HTTP/1.1 511 Network Authentication Required
Content-Type: text/html
Cache-Control: no-store511 is not cacheable by default: a browser or CDN stores it only when Cache-Control or Expires explicitly allows it.
To inspect a real one without sending it anywhere:
- Copy the response headers from your browser Network tab, or from
curl -i. - Paste them into the Header decoder to see every header explained.
- Check caching in the Cache lane.
Which Status Codes Are Related to 511?
- 401 Unauthorized: Authentication is missing or failed. Must send WWW-Authenticate. Really means "unauthenticated".
- 407 Proxy Authentication Required: Like 401, but the proxy needs credentials.
- 403 Forbidden: The server knows who you are and refuses anyway. Logging in again will not help.
Browse every code on the HTTP status codes page.
What Other Lanes Are in the Reference Section?
- HTTP status codes: Every IANA-registered status code, with a page per code.
- MIME types: File extensions to Content-Type, searchable both ways, plus a Content-Type parser.
- HTTP methods: GET, POST, PUT, PATCH, DELETE and the rest: safe, idempotent, cacheable.
Elsewhere in 2http: Header decoder, Cookie decoder, Cache-Control decoder, CORS checker, User-agent parser, and all eleven lanes on the 2http home page. Part of the 2suite.io privacy-first ecosystem.
Frequently Asked Questions
Can a website send 511?
It should not. The code is meant only for network infrastructure such as captive portals that intercept traffic, not for origin servers.
Is HTTP 511 an error?
Yes. 511 is a server error response: the server failed to handle a valid request, so retrying later may work.
Is a 511 response cacheable by default?
No. Caches store a 511 only when Cache-Control or Expires explicitly allows it.
How Can You Verify That Nothing Leaves This Browser?
You do not have to take our word that your headers stay here. Developer tools show every request a page makes, so you can watch this page work and confirm that nothing is sent. The check takes under a minute.
- Open your browser developer tools with
F12, orCmd+Option+Ion a Mac, and select the Network tab. - Reload the page and let it finish. You will see the page's own files, its web fonts, and one anonymous page-view request. Nothing has been typed yet, so none of them can contain your headers.
- Click the clear icon in the Network tab so that the log is empty.
- Paste real headers into any lane and read the result.
- Look at the Network tab again. It is still empty. For extra proof, turn on offline mode after the page loads and every lane keeps working.
Only two things can add a line to that log, and neither carries your headers. Submitting the feedback form sends the vote and comment you typed. Typing characters in a script the page has not displayed yet, such as Cyrillic or Greek, can make the browser fetch the matching font file, and that request names only the font.
2http never sends a request on your behalf: the request builder writes code for you to run, and the meta inspector reads source you paste instead of fetching a URL. The production site also sends a Content-Security-Policy header that tells your browser to refuse connections to anywhere except this site and the anonymous analytics endpoint.