Protected-site HTTP status codes
Your site's HTTP responses are separate from API responses. An origin can return its own status; Balancer can also return a local response before contacting your origin.
Local and application responses
| Status | Meaning |
|---|---|
| Origin status | The application's response, subject to configured response handling |
| 403 | Source block or an earlier security decision rejects the request |
| 429 | A request budget is exhausted or bucket cardinality admission fails |
| 502 | Security policy evaluation fails, a selected policy is missing or inactive, or required rate-limit bucket input is missing |
Local rate-limit 429 responses are HTML, use Cache-Control: no-store and do not set Retry-After. A WAF allow match cannot undo an earlier 403 or 429.
TLS handshake failures and raw TCP or UDP failures do not necessarily produce an HTTP response. Custom error-page replacement can change the response body; HEAD and gRPC responses are excluded from replacement.
TODO(verify): Complete the protected-site status-code inventory for redirects, route authentication, challenges, WAF rejection, origin transport failures and image processing using operation-level or topic evidence with exact codes.
See API errors for management API failures.