426 vs 505: Upgrade Required vs HTTP Version Not Supported
Both codes involve HTTP protocol version mismatches, but 426 asks the client to upgrade while 505 refuses to serve the client’s version at all.
| Aspect | HTTP 426 — Upgrade Required | HTTP 505 — HTTP Version Not Supported |
|---|---|---|
| RFC | RFC 9110, Section 15.5.22 | RFC 9110, Section 15.6.6 |
| Meaning | Server refuses to process the request on the current protocol; requires an upgrade | Server does not support the HTTP protocol version used in the request |
| Direction | Server tells client: use this better protocol instead | Server tells client: I don’t know your protocol version at all |
| Required header | Upgrade header listing acceptable protocol(s) | None required |
| Common scenario | Server requires TLS/WebSocket upgrade from HTTP/1.1 | HTTP/0.9 or future HTTP version sent to a server that doesn’t support it |
| Client action | Reconnect using the protocol in the Upgrade header | Retry with HTTP/1.1 or 1.0 |
| Cacheable | No | No |
426: Please Use a Better Protocol
426 Upgrade Required is used when a server requires the client to switch to a different protocol before it will process the request. The server includes an Upgrade header specifying which protocols are acceptable.
The most common modern use case is requiring TLS. A server that only operates over HTTPS may return 426 to HTTP connections rather than silently redirecting:
GET /api/data HTTP/1.1
Host: api.example.com
HTTP/1.1 426 Upgrade Required
Upgrade: TLS/1.3, TLS/1.2
Connection: Upgrade
Content-Type: application/json
{"error": "upgrade_required",
"message": "This API requires TLS. Use https://"}Another use case is WebSocket upgrades. A WebSocket server that receives a non-upgrade HTTP request at its WebSocket endpoint may return 426 with Upgrade: websocket.
In practice, most servers prefer to return 301 to redirect HTTP to HTTPS rather than 426, because browsers follow redirects automatically. 426 is more common in API contexts where a redirect would not be appropriate.
505: This HTTP Version Is Unknown
505 HTTP Version Not Supported means the server does not support the major HTTP version used in the request line. Every HTTP request starts with a version declaration: HTTP/1.0, HTTP/1.1, HTTP/2. If a server receives a version it does not understand, it returns 505.
This is rare in practice because HTTP/1.0 and 1.1 are universally supported, and HTTP/2 and HTTP/3 are negotiated via ALPN during TLS (not in the request line). The most likely scenario for 505 today is a badly written HTTP client that sends a malformed version string, or a client testing a hypothetical future HTTP version.
GET /page HTTP/9.0
Host: example.com
HTTP/1.1 505 HTTP Version Not Supported
Content-Type: text/plain
HTTP version 9.0 is not supported. Use HTTP/1.1.Decision Rule
Use 426 when your server requires a specific protocol upgrade (TLS, WebSocket) and the client used the wrong protocol. Always include the Upgrade header listing acceptable protocols.
You will rarely need to explicitly return 505 — HTTP server frameworks handle version negotiation automatically. If you do need to reject a specific HTTP version, 505 is the correct code.
FAQ
Should I use 426 or 301 to enforce HTTPS?
301 Moved Permanently is better for browser clients because browsers follow redirects automatically. 426 is better for API clients that should not follow redirects and where you want an explicit error. Many servers do both: nginx can return 301 for browser traffic and 426 for API endpoints under the same HTTP-only vhost.
Is HTTP/2 negotiated using 426?
No. HTTP/2 is negotiated via TLS ALPN (Application-Layer Protocol Negotiation) during the TLS handshake, before any HTTP request is made. 426 is not involved. A server that supports HTTP/2 advertises it via ALPN, and clients that support HTTP/2 use it automatically when the server agrees.
What causes 505 in production?
Very rarely: a malformed HTTP client sending a broken version string, an HTTP/0.9 client hitting a modern server, or a proxy with a version negotiation bug. In normal production traffic with modern clients, 505 is essentially never seen.