What does HTTP 418 actually mean?
Every HTTP response starts with a three-digit status code: 200 means here you are, 301 means it moved, 404 means there is nothing here, 500 means the server fell over. The 4xx block is for client errors, things the requester did wrong. And in the middle of that block, between 417 Expectation Failed and 421 Misdirected Request, sits 418 I’m a teapot, whose entire specification is that the server refuses to brew coffee because it is, permanently, a teapot. MDN adds the one refinement that makes it a proper spec: A combined coffee/tea pot that is temporarily out of coffee should instead return 503.
Where did the teapot come from?
On 1 April 1998 the IETF published RFC 2324, the Hyper Text Coffee Pot Control Protocol (HTCPCP/1.0), written by Larry Masinter, then at Xerox PARC. It is a complete, deadpan protocol for controlling coffee pots over the web: a coffee: URI scheme, a BREW method (with POST permitted as a fallback), an Accept-Additions header for milk, syrup and sweetener, and error handling for the case where the pot you are addressing is not a coffee pot at all. That case is 418. The document was an April Fools RFC, a tradition the IETF has kept since 1978, but it was also a quiet argument about the fashion for pushing HTTP into every device, made in the only way engineers reliably listen to.
Sixteen years later, on 1 April 2014, RFC 7168 extended the protocol to tea (HTCPCP-TEA), adding an Alternates header for listing available teas and the observation that pots which are teapots should say so with 418. The joke had acquired an errata process.
How was 418 nearly deleted, and who saved it?
By 2017 the code had leaked out of the joke and into real software. Node.js, Go’s standard library, Python’s Requests and Microsoft’s ASP.NET all shipped 418 in their status tables, and a scattering of production servers used it for requests they did not want to dignify with a real error. In August 2017 Mark Nottingham, chair of the IETF working group that maintains HTTP, opened issues asking those projects to remove it, on the entirely reasonable grounds that 418 had never been part of the HTTP standard and the number might one day be needed.
The response came from Shane Brunswick, a fifteen-year-old developer about to start his sophomore year of high school, who put up save418.com with the line that carried the campaign:
It’s a reminder that the underlying processes of computers are still made by humans. It’d be a real shame to see 418 go.
The projects kept the code. Nottingham and Brunswick reached an agreement, and Nottingham himself filed the proposal to reserve 418 formally so the question could never come up again, closing the thread with If you ask me, it’s a tempest in a ... ah, never mind.
Why can 418 never mean anything serious now?
The current HTTP semantics specification, RFC 9110 (June 2022), lists 418 under the heading “418 (Unused)” and reserves it precisely because it was so widely deployed as a joke, so that it cannot be assigned any non-joke semantics for the foreseeable future. That is the unusual part. The standards body did not merely tolerate the teapot; it wrote the teapot into the standard as a hole that must stay empty. Google’s search engine keeps its own tribute at google.com/teapot, which pours when you tilt your phone.
Which other status codes have a sense of humour?
| Code | Name | Standing | The story |
|---|---|---|---|
| 418 | I’m a teapot | Reserved by RFC 9110 | The one above. An April Fools RFC that outlived its joke. |
| 451 | Unavailable For Legal Reasons | Official, RFC 7725 (2016) | Proposed by Tim Bray for content blocked by court order or government demand. The number is a deliberate nod to Ray Bradbury’s Fahrenheit 451, the temperature at which books burn. Funny and grim at once, which is the point. |
| 402 | Payment Required | Official but reserved for future use since 1997 | Defined in HTTP/1.1 for a micropayment system that never arrived. Nearly thirty years later it is still waiting, and a handful of API companies now use it anyway. |
| 420 | Enhance Your Calm | Never official | Twitter’s original rate-limit response, borrowed from the film Demolition Man. Retired in favour of the standard 429 Too Many Requests, which arrived in RFC 6585 in 2012. |
| 444 | No Response | nginx only | Not a response at all: nginx closes the connection without sending anything, and logs 444 so operators know it did so on purpose. |
| 999 | Request Denied | LinkedIn only | LinkedIn’s answer to scrapers. Outside the defined 1xx to 5xx range entirely, which is its own kind of joke. |
| 7xx | Developer Errors | A GitHub repository, never a proposal | A community list of the codes developers wish existed: 725 It works on my machine, 750 Didn’t bother to write docs, 787 Further funding required. |
How do you get a 418 from laurelinlabs.com?
Ask this site for coffee. https://www.laurelinlabs.com/coffee returns status 418 with a plain-text teapot, an Accept-Additions header listing the milk, syrup and sweetener it would accept if it were not a teapot, and an X-Teapot: permanently header for the avoidance of doubt. Send Accept: application/json and it answers as a problem-details document instead. POST stands in for BREW, since this framework only routes the standard verbs. From a terminal:
curl -i https://www.laurelinlabs.com/coffee
curl -i -H "Accept: application/json" https://www.laurelinlabs.com/coffeeThe endpoint is marked noindex and kept out of the sitemap, because to a crawler a 418 is an error and the correct behaviour is to leave it alone. The teapot is also named in the comment at the top of every page’s source, next to an ASCII portrait of the author, for the people who read source.
Why does a joke status code matter to a site about being the answer?
Because the whole of technical SEO rests on status codes being honest. A 200 is a promise that there is something here worth indexing; a 301 is a promise that the thing moved; a soft 404 that returns 200 is a lie that costs crawl budget and trust. 418 is the reminder, written into the standard by people who clearly enjoyed their work, that these numbers were made by humans for humans to read. A site that gets its status codes right, including the one that refuses coffee, is a site a machine can believe. That belief is what the trust signals pillar is built on, and it is a better reason to keep the teapot than nostalgia.