What it means
The code comes from the April Fools' RFC 2324 (1998) describing a protocol for controlling coffee pots. It isn't an official part of the HTTP standard, but it is reserved so nobody uses it for anything else. Some servers and protections deliberately return it to requests they want to reject.
Most common causes
- An Easter egg or developer joke.
- Bot protection that returns 418 to automated requests.
- A test endpoint in an API.
What you can do as a visitor
- If you get a 418 on a real site, bot protection may have flagged you. Try without a VPN or extensions.
What the site owner or developer should do
- For real rejections, use a standard code (403 or 429).
- If a WAF is returning 418, check which rule is triggering it.
Impact on SEO and Google
If Googlebot gets a 418, the page won't be indexed. Don't return it on public pages.
Frequently asked questions
Is 418 a real code?
It's reserved in the IANA registry, but it isn't part of the HTTP standard for actual use.
Why am I getting a 418 on a real site?
Most likely bot protection flagged you as an automated visitor.