The client must log in to get network access.
When to use it
Captive portals on hotel and airport Wi-Fi.
Common causes and fixes
511 is meant for captive portals: hotel, airport or café Wi-Fi that intercepts traffic until you log in or accept terms. The portal should answer 511 with a login link instead of impersonating the site you asked for. Operating systems detect portals by fetching known URLs such as captive.apple.com or connectivitycheck.gstatic.com/generate_204 and opening a login window when the answer is unexpected.
HTTPS can’t be intercepted cleanly, so on portal networks you usually see certificate errors instead of a 511; opening a plain http:// site such as neverssl.com brings up the login page. Caches must never store a 511, and apps should treat it as a network problem, not an API error. Your own origin servers should never send it.
Server error (5xx)
5xx codes are server errors: the request may be fine, but the server or something behind it failed. These are worth alerting on.
What it looks like
HTTP/1.1 511 Network Authentication RequiredHow to send it
| Node.js / Express | res.status(511).end() |
|---|---|
| Python / Flask | return '', 511 |
| nginx | return 511; |
How to check it
curl -s -o /dev/null -w "%{http_code}\n" https://example.com/