511 Network Authentication Required

The client must authenticate to gain network access, typically shown by a captive portal before internet access is granted.

Defined in RFC 6585 §6

What 511 means

HTTP 511 Network Authentication Required, defined in RFC 6585, indicates that the client needs to authenticate to gain network access before its request can be fulfilled. It exists specifically to solve a problem that predates it: captive portals on public Wi-Fi in airports, hotels, cafes, and campuses used to intercept HTTP requests and return a 200 OK with a login page instead of the actual resource the client asked for, which silently broke HTTPS connections, cached responses incorrectly, and confused any client expecting the real content. 511 lets the network intercept the request but say so honestly, with a status code that unambiguously means access is blocked pending authentication.

In practice, a captive portal only injects a 511 response for plain HTTP requests, since it cannot intercept and rewrite HTTPS traffic without triggering a certificate warning; operating systems exploit this by sending an unencrypted HTTP probe to a known URL right after joining a network specifically to detect a captive portal, and treat any redirect or 511 response on that probe as the signal to pop up a login browser. Once the user completes the portal's login flow, typically by accepting terms or entering a room or membership code, the gateway allows that device's traffic through and subsequent requests succeed normally.

Common causes

The device has just joined a public Wi-Fi network, such as an airport, hotel, cafe, or transit system, that requires accepting terms or logging in through a captive portal before granting internet access.
The captive portal's authentication session has expired, requiring the device to re-authenticate even though it was previously connected.
A corporate or campus network enforces 802.1X or portal-based authentication and the device has not completed that handshake yet.

How to fix a 511

If you are the client (browser user or API caller)

Open a browser and complete the captive portal's login or terms-acceptance page before making other network requests.
If the portal page does not appear automatically, manually navigate to a plain HTTP, not HTTPS, URL to trigger the captive portal's redirect.
For automated devices or scripts that need real internet access, avoid running them immediately on untrusted public networks that use captive portals, since 511 will block anything other than the portal login flow.

If you run the server

Ensure the captive portal gateway returns a proper 511 response instead of silently substituting a 200, so clients and operating systems can detect the portal reliably.
Keep the captive portal's authentication session lifetime reasonable and clearly communicate expiry so users are not unexpectedly cut off mid-session.

Example

GET / HTTP/1.1
Host: example.com

HTTP/1.1 511 Network Authentication Required
Content-Type: text/html

<html><body><h1>Network Login Required</h1>
<p>Please sign in to the hotel Wi-Fi to continue.</p>
</body></html>

A hotel Wi-Fi captive portal intercepts a plain HTTP request and returns 511 instead of the requested page until the guest logs in.

Try it live

Our free status responder returns a real HTTP 511 you can point tests, monitors or a browser at.

GET https://mcp.httpstatus.com/status/511