---
title: "511 Network Authentication Required — what it means and how to fix it"
description: "You need to log in to the network itself — this is a captive portal, not the site you asked for. What causes an HTTP 511, what to try as a visitor, and what to check if it is your own site."
url: https://atoneplace.net/error/511/
site: "At One Place"
---

# HTTP 511 — Network Authentication Required

**HTTP 511: Network Authentication Required**

You need to log in to the network itself — this is a captive portal, not the site you asked for.

## What 511 actually means

The response did not come from the site at all. Something between you and the internet — hotel Wi-Fi, an airport network, a coffee shop hotspot — is intercepting traffic until you accept terms or sign in. The code exists so that clients can tell a captive portal apart from a genuine site response, which matters because portals otherwise appear to be the site lying to you. It is defined as a 5xx precisely because the origin server never saw the request.

## Common causes

- A hotel, airport or café captive portal awaiting sign-in
- A guest network requiring terms to be accepted
- A corporate network requiring authentication before internet access
- A paid hotspot whose session has expired

## If you're just trying to view the page

1. Open any plain http:// page — most portals cannot intercept HTTPS, which is why the login screen never appears when you only try secure sites
2. On a phone, tap the Wi-Fi network name; both iOS and Android offer a "sign in to network" option that opens the portal
3. Try visiting neverssl.com or captive.apple.com, which exist for exactly this purpose
4. Forget the network and reconnect to trigger the portal detection again

## If it's your site

1. If you operate the portal, return 511 with a `Link` header to the login page rather than silently redirecting — silent interception breaks HTTPS and looks like an attack
2. Do not use 511 on an origin server; it is specifically for intercepting proxies
3. Client applications should handle 511 by prompting the user rather than retrying

## Reference

- **Status code:** 511
- **Reason phrase:** Network Authentication Required
- **Category:** 5xx — Server Error
- **Cacheable by default:** No
- **Defined in:** RFC 6585 §6

## Common questions

### What does HTTP 511 mean?

You need to log in to the network itself — this is a captive portal, not the site you asked for. The response did not come from the site at all. Something between you and the internet — hotel Wi-Fi, an airport network, a coffee shop hotspot — is intercepting traffic until you accept terms or sign in.

### How do I fix a 511 error?

Open any plain http:// page — most portals cannot intercept HTTPS, which is why the login screen never appears when you only try secure sites

### Is 511 a client error or a server error?

511 is in the 5xx range, which means server error. The request was acceptable but the server could not fulfil it, so retrying later can succeed.

## Related pages

- [500 Internal Server Error](https://atoneplace.net/error/500/)
- [502 Bad Gateway](https://atoneplace.net/error/502/)
- [503 Service Unavailable](https://atoneplace.net/error/503/)
- [504 Gateway Timeout](https://atoneplace.net/error/504/)
- [524 A Timeout Occurred](https://atoneplace.net/error/524/)
- [521 Web Server Is Down](https://atoneplace.net/error/521/)
- [522 Connection Timed Out](https://atoneplace.net/error/522/)
- [520 Web Server Returned an Unknown Error](https://atoneplace.net/error/520/)
- [525 SSL Handshake Failed](https://atoneplace.net/error/525/)
- [526 Invalid SSL Certificate](https://atoneplace.net/error/526/)
- [530 Origin DNS Error](https://atoneplace.net/error/530/)
- [501 Not Implemented](https://atoneplace.net/error/501/)

## Sources

- Hypertext Transfer Protocol (HTTP) Status Code Registry — IANA (https://www.iana.org/assignments/http-status-codes/)
- RFC 9110: HTTP Semantics — IETF (https://www.rfc-editor.org/rfc/rfc9110.html)