---
title: "425 Too Early — what it means and how to fix it"
description: "The server will not risk processing a request sent in TLS early data, because it could be replayed. What causes an HTTP 425, what to try as a visitor, and what to check if it is your own site."
url: https://atoneplace.net/error/425/
site: "At One Place"
---

# HTTP 425 — Too Early

**HTTP 425: Too Early**

The server will not risk processing a request sent in TLS early data, because it could be replayed.

## What 425 actually means

TLS 1.3 lets a client send data in the very first flight — "0-RTT" or early data — to save a round trip. The catch is that early data can be captured and replayed by an attacker, which is harmless for a page view and dangerous for a payment. A 425 is the server declining to act on early data for a request that is not safe to repeat, and asking the client to send it again over the fully established connection.

## Common causes

- A non-idempotent request sent in TLS 1.3 early data
- A CDN configured to reject 0-RTT for state-changing methods
- Replay protection triggering on a repeated early-data request

## If you're just trying to view the page

1. Nothing — the client retries automatically over the completed handshake
2. If a payment or form submission fails once and works on retry, this may be why, and the retry is the safe behaviour

## If it's your site

1. Only allow 0-RTT for safe, idempotent requests; reject anything that writes
2. Check the `Early-Data: 1` header to detect early data on the origin side
3. Cloudflare and other CDNs let you configure 0-RTT per zone; turn it off entirely if replay risk is unacceptable

## Reference

- **Status code:** 425
- **Reason phrase:** Too Early
- **Category:** 4xx — Client Error
- **Defined in:** RFC 8470 §5.2

## Common questions

### What does HTTP 425 mean?

The server will not risk processing a request sent in TLS early data, because it could be replayed. TLS 1.3 lets a client send data in the very first flight — "0-RTT" or early data — to save a round trip. The catch is that early data can be captured and replayed by an attacker, which is harmless for a page view and dangerous for a payment.

### How do I fix a 425 error?

Nothing — the client retries automatically over the completed handshake

### Is 425 a client error or a server error?

425 is in the 4xx range, which means client error. The request itself was the problem, so retrying it unchanged will usually return the same code.

## Related pages

- [404 Not Found](https://atoneplace.net/error/404/)
- [403 Forbidden](https://atoneplace.net/error/403/)
- [401 Unauthorized](https://atoneplace.net/error/401/)
- [429 Too Many Requests](https://atoneplace.net/error/429/)
- [400 Bad Request](https://atoneplace.net/error/400/)
- [413 Content Too Large](https://atoneplace.net/error/413/)
- [422 Unprocessable Content](https://atoneplace.net/error/422/)
- [405 Method Not Allowed](https://atoneplace.net/error/405/)
- [409 Conflict](https://atoneplace.net/error/409/)
- [415 Unsupported Media Type](https://atoneplace.net/error/415/)
- [408 Request Timeout](https://atoneplace.net/error/408/)
- [410 Gone](https://atoneplace.net/error/410/)

## Sources

- Hypertext Transfer Protocol (HTTP) Status Code Registry — IANA (https://www.iana.org/assignments/http-status-codes/)
- RFC 9110: HTTP Semantics — IETF (https://www.rfc-editor.org/rfc/rfc9110.html)