418 I'm a Teapot

The story of HTTP 418 — the April Fools' HTCPCP status code that became the web's favorite easter egg — plus what actually happens when Google meets a 418, and why a WAF returning it on real pages is a problem.

First published: Jul 4, 2026 · Last updated: Aug 29, 2026 · Advanced
demand #8 in HTTP Errors#14 in HTTP Status Codes#84 in Technical SEO#110 on the site
1 evidence signal on this page

HTTP 418 I'm a teapot is a joke status code from the 1998 April Fools' HTCPCP RFC (RFC 2324): a teapot asked to brew coffee must refuse, because it's a teapot. It never got ordinary HTTP application semantics, but it's not 'unassigned' — RFC 9110 formally reserves the code, and IANA's registry lists it as (Unused), not available for ordinary reuse. A 2017 attempt to reclaim it lost to a 'save 418' campaign. Google's dated 2023 guidance treats 418 like any other non-429 4xx for Search, and its current generic crawler-status page doesn't cover exotic codes like this one at all. That only matters in practice when a WAF or bot-protection layer uses 418 to block requests (some do) and accidentally serves it to Googlebot — audit for it like any other 4xx. This site's /coffee URL returns a genuine 418, per the RFC.

TL;DR — Treat an unexpected 418 as an ordinary non-429 4xx with an unusual producer. Capture the raw response, identify which application, WAF, CDN, or origin layer emitted it, verify the result with the affected crawler path, and keep monitoring until important URLs consistently return their intended status.

Interpret the signal before changing anything

The status code tells you how the response is classified, not which system chose it. Google’s cited guidance places 418 in the general non-429 4xx behavior: the content is not used for indexing, and a previously indexed URL can be removed over time. It does not define a special teapot recovery process or timeline.

Start with one affected URL and preserve the evidence you will need to compare layers: request time, request path, response status, response headers, and body. Confirm whether the response is stable or depends on user agent, IP, authentication, rate, geography, or another request condition.

Isolate the emitting layer

Work from the public response inward:

  1. Reproduce the response with a raw request and record its headers and body.
  2. Match the same path and time in CDN, WAF or bot-protection, origin, framework, and application logs.
  3. Compare a normal browser request with the affected crawler request without assuming that the visible error-page text identifies the producer.
  4. Change only the rule or code path proven to emit 418; a named framework constant is not evidence that the framework sends it by default.

Verify the recovery

Retest the exact URL through the same request path that failed. The expected result is the status the resource actually requires—usually 200 for a live indexable page, or the intentional redirect or removal status for another lifecycle state. Then sample neighboring URLs governed by the same rule so a narrow fix does not leave a pattern-wide block in place.

Keep a log or crawl alert for new 418 responses on indexable URLs. The site’s intentional /coffee response is a useful control: it should remain 418, while production pages should not inherit that behavior.

Try it live

This is a real endpoint on this site — not a simulation. Hit it from the button, open it in a new tab, or curl -i from your terminal, and the server answers with the actual status code this article is about.

Open in new tab ↗

Add an expert note

Pin an expert quote

New person? Create their unclaimed profile at /admin/experts/ → Pin an expert quote first.