> ## Documentation Index
> Fetch the complete documentation index at: https://gcore-doc-1894.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Gcore CDN error status codes
HTTP status codes in CDN logs show the outcome of a request. This article covers selected codes that have Gcore-specific causes or resolution steps. Several causes can produce the same code, so each table lists the Gcore-specific causes and the matching fix.
## Status codes in Log viewer
In the [Gcore Customer Portal](https://portal.gcore.com), navigate to **CDN** > **Logs** > **Log viewer**. Use **Search by CNAME or ID**, the time range, or **Add filter**. Delivery outcomes appear in the **Status code** column. The [Log viewer](/cdn/logs/log-viewer-view-and-download-cdn-resource-logs) stores the last 3 days of requests, with a maximum view interval of 6 hours.
## Error status codes
Status codes `403`, `404`, and `410` each cover more than one cause. The tables list the cause, what it means, and how to resolve it.
### 403 errors
A `403` can originate from the CDN or from the origin. CDN-side causes include a suspended resource, an access policy, and Secure Token validation failures. The table below covers the most common CDN causes.
| Cause | Details | Solution |
| ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| The CDN resource is suspended. | The **Content availability** toggle controls whether the resource serves content. When the toggle is off, the resource does not serve content. | In **CDN** > **CDN resources**, select the resource. Enable **Content availability**. Automatic and manual [resource suspension](/cdn/cdn-resource-options/general/suspend-a-cdn-resource-automatically-or-manually) share this toggle. |
| An access policy blocks the client. | Country, referrer, IP, or user-agent policies can return `403`. | In resource settings, open **Access** and review **Country access policy**, **Referrer access policy**, **IP access policy**, and **User agents policy**. Disable or adjust the policy that matches the blocked client. If a country policy blocks Angola, clients in Angola receive `403`. |
| Secure Token validation fails. | A [Secure Token](/cdn/cdn-resource-options/security/use-a-secure-token/about-secure-token) request is rejected when the token is missing or invalid, when the request path does not match the signed path, or when the client IP does not match the IP bound to the token. An expired token returns `403` or `410` depending on the CDN resource configuration. | Review the token generation logic in [Secure Token](/cdn/cdn-resource-options/security/use-a-secure-token/configure-and-use-secure-token). Verify the token is present, covers the correct path, and — if IP binding is enabled — matches the client IP. For expired tokens, check the expiry time and whether the resource is configured to return `403` or `410`. |
Each policy supports an allow list or a block list in [access policies](/cdn/cdn-resource-options/security/control-access-to-the-content-with-country-referrer-ip-and-user-agents-policies).
### 410 errors
A `410` from Gcore CDN means a [Secure Token](/cdn/cdn-resource-options/security/use-a-secure-token/about-secure-token) request was rejected because the token has expired, and the CDN resource is configured to return `410` for expired tokens. Resources configured to return `403` for the same condition will not produce `410`.
| Cause | Details | Solution |
| ------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| The Secure Token has expired and the resource returns `410` for expired tokens. | Token expiry produces `403` or `410` depending on the CDN resource configuration. | Regenerate a valid token. In [Secure Token settings](/cdn/cdn-resource-options/security/use-a-secure-token/configure-and-use-secure-token), check the expiry time and adjust the configured response code if needed. |
### 404 errors
A `404` can mean the origin has no object at that path. Some CDN options also return `404` when the origin fetch fails.
A missing object on the origin is the usual case:
| Cause | Details | Solution |
| -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| The origin does not have the requested file. | The HTML file links to an object through the CDN, but that path does not exist on the origin. Example: `https://cdn.example.com/files/image.png` when `image.png` is missing from the `files` directory. | Place the object on the origin at the same name and path as the HTML link, or edit the HTML link. To stop delivering the object through CDN, remove the link from the page. |
These resource options can also produce `404` even when the path exists:
| Cause | Details | Solution |
| ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| WebP compression and WebSockets conflict. | [WebP compression](/cdn/cdn-resource-options/image-optimization-paid/image-stack-tools/configure-image-compression-to-webp-and-avif) and [WebSockets](/cdn/cdn-resource-options/websockets-allow-permanent-connections-with-the-origin) cannot be enabled at the same time. | Disable one of the two options. |
| The Host header is incorrect. | The **Host header** option tells CDN nodes which origin hostname to request. A mismatched value can route the request to the wrong virtual host on the origin and produce a `4xx` or `5xx` response. Some origins accept multiple hostnames or use a default virtual host and may not return an error. Example: origin `mycontent.com` with Host header `website.com`. The header does not change automatically when the origin changes. | Set the correct value in the [Host header](/cdn/cdn-resource-options/http-headers/configure-and-check-the-host-header) option. |
| Origin access is restricted for the CDN. | The CDN cannot fetch content when the origin ACL blocks Gcore addresses. This case can also return `504`. | Allowlist CDN servers in the [origin ACL](/cdn/getting-started/configure-an-origin/add-cdn-servers-to-the-origin-acl-whitelist). If IP allowlisting is not practical, send an identifying header with [Request headers](/cdn/cdn-resource-options/http-headers/specify-http-headers-that-cdn-adds-to-requests-to-the-origin). |
### Other errors (402, 504, 508, 556, 557)
These additional codes each have a primary cause. A `504` means the CDN did not get a timely origin response. A blocked origin ACL is one cause. Timeouts, an unreachable origin, or origin overload can produce the same code.
| Status code | Cause | Details | Solution |
| ----------- | ----------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `402` | Video delivery is not enabled for the CDN account. | HLS and DASH types `.m3u8`, `.mpd`, `.ts`, `.m4s`, `.m4v`, and `.m4a` can return `402` until Gcore Support enables video delivery. | Request enablement in [streaming activation](/cdn/getting-started/create-a-cdn-resource/create-a-cdn-resource-for-video-streaming#step-1-request-streaming-activation). |
| `504` | The origin did not respond in time. | The CDN timed out waiting for the origin. A blocked origin ACL is one cause. An unreachable origin, a slow origin, or origin overload can also return `504`. | Test the origin directly with the correct TLS SNI by targeting the origin IP while keeping the origin hostname in the URL: `curl -sS -D - -o /dev/null --resolve origin.example.com:443:192.0.2.10 https://origin.example.com/path`. If the origin does not respond, check its reachability and firewall rules. If an ACL blocks Gcore addresses, apply the origin ACL or Request headers fix from the `404` table above. |
| `508` | The configured origin resolves back to the same CDN resource, forming a loop. | A loop occurs when the custom domain or Gcore-provided CDN hostname is set as the resource origin instead of the actual origin server. The custom domain CNAME must point to the Gcore target shown in [resource setup](/cdn/getting-started/create-a-cdn-resource/create-a-cdn-resource), and the resource origin must identify the actual origin server — not the CDN hostname or custom domain. | Set the resource origin to the actual origin server address. Fix the custom domain CNAME in [content unavailability](/cdn/troubleshooting/content-is-unavailable-after-a-cdn-resource-creation-how-to-solve-the-issue#1-check-the-configuration-of-the-personal-domain). Confirm that the custom domain's CNAME record points to the `*.gcdn.co` target shown in the resource's **Setup guide**. |
| `556` | The origin did not respond within the configured timeout. | Slow origins or overloaded servers can exceed connection or read limits. The default connection timeout is 5 seconds (time allowed to establish a connection). The default read timeout is 30 seconds between successive read operations from the origin. | Review the [connection and read timeout](/cdn/cdn-resource-options/general/customize-connection-and-read-timeouts) settings for the CDN resource and confirm the origin responds reliably within those limits. |
| `557` | Simultaneous connections to one origin exceeded the limit. | Gcore CDN returns `557` when the number of simultaneous connections from one CDN location to a single origin server reaches 10,000. The limit is per origin server per CDN location. | Add origins to the [origin group](/cdn/add-an-origin-group) to distribute connections across multiple origin servers. |
#### HLS and DASH 402 responses
Requests for HLS or DASH manifests and segments can return `402` even when the files exist on the origin, because video delivery is not enabled yet.
#### TypeScript source files and 402
HLS media playlists often request MPEG Transport Stream segments with a `.ts` extension, so Gcore treats `.ts` as video delivery. Those requests can return `402` until streaming is enabled. The same extension is also used for TypeScript source files. If TypeScript files return `402`, compile them to JavaScript (`.js`) before delivery. Renaming a `.ts` file to `.js` without compiling does not produce valid JavaScript. Alternatively, contact [Gcore Support](mailto:support@gcore.com) to review the CDN resource configuration.