511 Network Authentication Required
The client needs to authenticate to gain network access, typically seen at captive portals like public Wi-Fi networks.
Meaning & Description
Common Causes
- Connecting to a public Wi-Fi network that requires agreeing to a Terms of Service page.
- A network subscription (like a cellular data plan) has expired, and the ISP intercepts traffic to show a billing page.
- Enterprise proxy servers requiring LDAP or Active Directory authentication before allowing outward internet traffic.
How to fix a 511 error
- Look for a login URL in the response body or HTML and open it in a browser to complete the network authentication.
- If you are a client script, you cannot bypass this; a human usually needs to interact with the captive portal, or you must script the portal login sequence.
- Ensure your device is not using strict DNS-over-HTTPS or a VPN that might be interfering with the local captive portal redirection.
Browser & SEO Behaviour
Browser Behavior
Modern operating systems and browsers detect this status code natively. When connected to a new network, if a background request returns a 511, the OS will automatically pop up a "Sign in to network" captive portal window.
SEO Impact
No impact. Search engine crawlers do not operate from behind public Wi-Fi captive portals.
CDN Behavior
Irrelevant. The 511 is returned by the local router/ISP intercepting the connection before it ever reaches the CDN or origin server.
Code Examples
HTTP/1.1 511 Network Authentication Required
Content-Type: text/html
<html>
<head><title>Wi-Fi Login</title></head>
<body>
<h1>Authentication Required</h1>
<p>Please <a href="http://192.168.1.1/login">login here</a> to access the internet.</p>
</body>
</html>const http = require("http");
http.createServer((req, res) => {
// Intercepting proxy logic for unauthenticated MAC addresses
res.writeHead(511, { "Content-Type": "text/html" });
res.end(`
<html>
<body>
<h1>Wi-Fi Login Required</h1>
<a href="http://portal.localnet/login">Click to agree to terms</a>
</body>
</html>
`);
}).listen(80);from flask import Flask, Response
app = Flask(__name__)
@app.route("/", defaults={"path": ""})
@app.route("/<path:path>")
def captive_portal(path):
# Return a 511 indicating network auth is required
html = "<html><body><a href='/login'>Login to Wi-Fi</a></body></html>"
return Response(html, status=511)package main
import "net/http"
func handler(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(511)
w.Write([]byte("<html><body><a href='http://gateway.local/login'>Network Login</a></body></html>"))
}
func main() {
http.HandleFunc("/", handler)
http.ListenAndServe(":80", nil)
}# Attempting to access Google on a restricted airport Wi-Fi
curl -I http://google.comRaw HTTP Response Example
HTTP/1.1 511 Network Authentication Required
Content-Type: text/html
Cache-Control: no-cache
<html><body><a href="http://wifi.airport.local/login">Login</a></body></html>Real-world Examples
Frequently Asked Questions
What is the difference between 401 Unauthorized and 511 Network Authentication Required?
401 is used by the application itself (e.g., Netflix asking for your password). 511 is used by the network infrastructure (e.g., the Airport Wi-Fi asking you to accept terms before you can even reach Netflix).
Why does a 511 error only work on HTTP and not HTTPS?
To return a 511, the router must intercept the connection and reply on behalf of the destination website. If the site is HTTPS, the router doesn't have the site’s SSL certificate, so the browser will throw a massive security warning before it can ever read the 511 code.
How do browsers know to show a Wi-Fi login screen?
When you connect to Wi-Fi, the OS sends a hidden plaintext HTTP request to a specific URL (like captive.apple.com). If the network intercepts it and returns a 511 (or a redirect to a login page), the OS knows it is trapped in a captive portal.
Did You Know?
The 511 status code was introduced in RFC 6585 in 2012 specifically to standardize captive portals, which previously relied on ugly DNS hijacking or generic 302 redirects.
It is the only HTTP status code designed specifically for middleboxes (routers and firewalls) rather than clients or end servers.
Developer Tips
- If you are building an API or a web app, you will never write code to return a 511. However, if your mobile app makes API calls, you should handle 511 gracefully by informing the user they need to log into the local Wi-Fi.
Interview Questions
These are questions you might face in a backend or API design interview that touch on HTTP 511.
You are building a REST API for a SaaS product. When should you use the 511 status code?
Never. The 511 status code is strictly for network-level captive portals (like hotel Wi-Fi). Application-level authentication should use 401 Unauthorized.
Why does intercepting an HTTPS connection to return a 511 not work smoothly?
Because intercepting an HTTPS request requires presenting a valid SSL certificate for the requested domain. A local Wi-Fi router does not own the certificate for google.com, so the browser will hard-block the connection with a TLS mismatch error before it can process the 511 status.
Common Interview Mistakes
- Confusing 511 Network Authentication with 407 Proxy Authentication Required. 407 means the browser is explicitly configured to use a proxy and must authenticate with it. 511 means an invisible middlebox hijacked a normal connection to demand authentication.