Status Code 413
Content Too Large
The request is larger than the server is willing or able to process.
Category
Client ErrorSpec URL
413 of RFC 9110Popularity
common
Recommended
Yes
Deprecated
No
Common Use Case
File upload exceeds size limit
Notes
Used when the request payload is too large to be processed.
RFC Reference
Description
The request is larger than the server is willing or able to process.
A typical server response for a 413 Content Too Large status code looks like:
HTTP/1.1 413 Content Too Large
Date: Sun, 22 Mar 2026 12:00:00 GMT
Server: httperrors.com
Content-Type: application/json
{
"error": {
"code": 413,
"message": "Content Too Large"
}
}Client errors are not always signs of a broken application. Many of them are deliberate contract signals that help API consumers, browsers, and operators understand what must change before retrying.
Historically, HTTP 413 Content Too Large should be read in light of RFC 9110. Standards text tends to focus on precise semantics, while production systems care about retries, user experience, dashboards, proxies, browsers, and documentation. Good engineering joins those two views instead of choosing one over the other. When teams treat a status code as both a protocol message and a product decision, they produce APIs and pages that are easier to operate and easier to trust.
A practical reading of this entry is that the server is communicating something very specific: The request is larger than the server is willing or able to process. In day-to-day work, that meaning should be reflected across controllers, reverse proxies, API gateways, and frontend assumptions. If the server sends HTTP 413, but the response body, cache headers, or application behavior tell a different story, client code starts compensating for inconsistency and the whole stack becomes harder to reason about.
The normative anchor here is RFC 9110, with a direct reference at https://datatracker.ietf.org/doc/html/rfc9110#section-15.5.14. That RFC context matters because the exact words in the standard often settle edge cases around caching, retries, authentication, payload requirements, or intermediary behavior.
A useful client error response should do more than fail fast. It should tell the caller enough to correct the request without exposing unnecessary internals or creating security leaks.
In implementation terms, HTTP 413 Content Too Large should appear at a deliberate decision point in your request handling code. Avoid choosing it late as a cosmetic label after the rest of the response is already formed. Automatic retries are usually the wrong first move unless the client can correct the original request before sending it again. If your logs show this status frequently, the surrounding context should make it obvious whether the response reflects normal traffic or a design problem.
For HTTP 413 Content Too Large, the short description is only the starting point. The more useful interpretation is how a real client should react after seeing this response in a live request cycle. The request is larger than the server is willing or able to process.
A useful way to compare HTTP 413 is against other 4xx responses that might look similar in dashboards. Choosing the wrong one can blur important distinctions between validation failures, authorization issues, missing resources, and unsupported operations. This is one reason protocol precision pays off over time: the better your status taxonomy, the easier it becomes to debug client behavior, build metrics, and explain edge cases to other engineers.
From an operational perspective, HTTP 413 should be visible in logs, metrics, and alerts with enough surrounding metadata to explain why it happened. Popularity for this entry is listed as common, and that should influence how much defensive documentation and monitoring you add. Because the code is common, it is worth distinguishing healthy uses from suspicious spikes so routine traffic is not mistaken for a regression.
Client error responses tell crawlers that the requested content is unavailable, invalid, restricted, or otherwise not ready to be processed. Used accurately, that helps search engines understand site quality. Used carelessly, it can make healthy content look broken or thin. For HTTP 413, the operational takeaway is that status correctness supports SEO indirectly by making crawl behavior more predictable. Pages, APIs, and edge routes should return this code only when its meaning is exactly true.
Since this code is marked as recommended, teams can confidently use it when the semantics are an exact match. The key word is exact. Recommendation does not mean convenience; it means the code is a strong standard choice when the surrounding conditions line up.
Because this code is not deprecated, it remains part of the active vocabulary that modern web systems can use. Even so, correctness still depends on discipline. A valid status code becomes harmful if teams reuse it as shorthand for several unrelated situations.
The supporting note for this entry is also important: Used when the request payload is too large to be processed. This often captures the gap between the formal specification and day-to-day engineering practice.
The best way to think about HTTP 413 Content Too Large is not as trivia, but as a promise. It tells the caller what happened, what should happen next, and how much confidence the client can place in the current response. The example recorded for this entry is File upload exceeds size limit, and the note says Used when the request payload is too large to be processed.. Together with the specification link at https://datatracker.ietf.org/doc/html/rfc9110#section-15.5.14, those details give implementers enough context to use the code intentionally rather than mechanically. That is the standard worth aiming for in production systems.
Other HTTP status codes in the Client Error category
The server cannot or will not process the request due to an apparent client error.
Malformed request syntax, invalid parameters
Similar to 403 Forbidden, but specifically for use when authentication is required and has failed or has not yet been provided.
Missing or invalid authentication credentials
Reserved for future use. The original intention was that this code might be used as part of some form of digital cash or micropayment scheme.
Digital payment systems (rarely used)
The request contained valid data and was understood by the server, but the server is refusing action.
Insufficient permissions, IP blocking
The requested resource could not be found but may be available in the future.
Broken links, deleted resources, typos in URL
A request method is not supported for the requested resource.
Using POST on a GET-only endpoint
The requested resource is capable of generating only content not acceptable according to the Accept headers sent in the request.
Client requests XML but server only has JSON
The client must first authenticate itself with the proxy.
Corporate proxy requiring authentication
The server timed out waiting for the request.
Client took too long to send request
Indicates that the request could not be processed because of conflict in the current state of the resource.
Version conflicts, duplicate resource creation
Indicates that the resource requested is no longer available and will not be available again.
Permanently deleted resources
The request did not specify the length of its content, which is required by the requested resource.
Missing Content-Length header
The server does not meet one of the preconditions that the requester put on the request header fields.
If-Match header conditions not met
The URI provided was too long for the server to process.
URL with too many query parameters
The request entity has a media type which the server or resource does not support.
Uploading unsupported file format
The client has asked for a portion of the file, but the server cannot supply that portion.
Invalid byte range in Range header
The server cannot meet the requirements of the Expect request-header field.
Expect: 100-continue not supported
This code was defined in 1998 as one of the traditional IETF April Fools' jokes.
April Fools' joke, some services use it humorously
The request was directed at a server that is not able to produce a response.
HTTP/2 connection reuse issues
The request was well-formed but was unable to be followed due to semantic errors.
Validation errors in request body
The resource that is being accessed is locked.
WebDAV locked resources
The request failed because it depended on another request and that request failed.
WebDAV dependent operations
Indicates that the server is unwilling to risk processing a request that might be replayed.
TLS early data concerns
The client should switch to a different protocol such as TLS/1.3.
HTTP to HTTPS upgrade requirement
The origin server requires the request to be conditional.
Prevent lost update problem
The user has sent too many requests in a given amount of time.
Rate limiting, API quotas exceeded
The server is unwilling to process the request because either an individual header field, or all the header fields collectively, are too large.
Cookie header too large
A server operator has received a legal demand to deny access to a resource or to a set of resources.
Content blocked due to legal requirements