511 Network Authentication Required — HTTP Status Code

What 511 means

511 Network Authentication Required means "you need to authenticate with this network before you can use it." It is defined in RFC 6585, Section 6. The response should contain a link to a page where the user can sign in, but it should not contain the login form itself, because the browser would then show that form as if it belonged to the site the user asked for.

RFC 6585 is direct about who sends it: origin servers should not, and it is intended for intercepting proxies that sit in the network to control access. Section 6.1 of the RFC explains that 511 exists to limit the damage captive portals do to software that expects an answer from the server it contacted, not to encourage captive portals.

When you see it

511 appears on networks that hold traffic until a user does something:

• Hotel, airport, café and train Wi-Fi that require a room number, a voucher or accepting terms.
• Guest networks in offices, hospitals and campuses.
• Paid or metered access where the session has expired and needs to be renewed.
• Corporate networks that require users to sign in to a web gateway before reaching the internet.

The device that sends it is the network's access gateway or proxy. The site in the URL bar is not involved.

Common causes

• The device just joined the network and the portal login has not been completed.
• The portal session timed out, so traffic is held again even though it worked earlier.
• A device without a browser, such as a smart TV, IoT sensor or server, is on a network that requires interactive login.
• A VPN or app tried to connect before the portal was cleared, and its first request was intercepted.

How to fix it

As a user:

1. Open a browser and visit any plain http:// site; many portals only intercept unencrypted traffic, so an HTTPS site may just fail to connect.
2. Complete the sign-in or accept the terms on the portal page.
3. Retry the original app or page.

As a developer of an app or API client:

1. Detect 511 explicitly and show a clear "sign in to this network" message instead of a generic error.
2. Do not parse the body as your API's response, and do not cache it.
3. If you can, open the link the response provides in a browser view so the user can log in.

As a network operator: if you run a captive portal, send 511 with a link to the login page, as RFC 6585 describes. It lets apps and devices understand what is happening instead of failing in confusing ways.

How to check it

From a machine on the suspect network, request a plain HTTP URL and look at the status and headers:

curl -s -D - -o /dev/null http://example.com/ | head -n 10

A 511, or a redirect to a domain that is clearly not example.com, means the network is intercepting traffic. Run the same command from a different network, such as a phone hotspot; a normal 200 there confirms the site is fine and the problem is local.

What it means for uptime monitoring

PingRobot's checker sends a GET with the user agent PingRobot/1.0 (+https://pingrobot.io/bot) from Cloudflare's network, follows redirects, and counts the final response as up only if its status is 200–399. A 511 would count as down, and failures are re-checked from a second region before alerting.

In practice, a 511 is a sign of a captive portal between a client and the site, not a site failure. Checks that run from data center networks normally have no captive portal in the path, so a monitor is unlikely to see 511 from a public site. If a monitor does report it, the response is probably not coming from your origin at all; find out which device is intercepting, for example a corporate gateway in front of an internal service. If users report 511 errors while your monitor is green, the problem is on their network, and the fix is for them to sign in to it.

Related codes

• 401 Unauthorized – the site itself wants credentials.
• 403 Forbidden – access refused by the server itself.
• 302 Found – what many captive portals use instead of 511.
• 451 Unavailable For Legal Reasons – another block that may come from the network.
• 505 HTTP Version Not Supported – another rare 5xx code.
• 503 Service Unavailable – a real server-side outage.

Start monitoring free — 10 monitors, no credit card.