HTTP 418 I'm a Teapot: the joke status code

What 418 means

418 is a joke that stuck. RFC 2324, published on 1 April 1998, defined the Hyper Text Coffee Pot Control Protocol (HTCPCP) for controlling coffee pots over the network, with a new method BREW and an error for a teapot asked to brew coffee. The RFC even notes that the body "MAY be short and stout":

HTTP/1.1 418 I'm a teapot
Content-Type: text/plain

I'm a teapot.

RFC 7168 (also an April Fools' RFC, 2014) extended HTCPCP to tea. Neither is part of HTTP. 418 isn't a standard HTTP status code: RFC 9110 §15.5.19 lists it as "(Unused)" and reserves it, so it won't be assigned to anything real, because so much software already knows it as the teapot.

The "Save 418" episode

In 2017 Mark Nottingham, then chair of the IETF HTTP working group, proposed removing 418 from Node.js, Go and other libraries, since it was never registered. Developers objected loudly ("Save 418"), the libraries kept it, and the IETF settled the matter by reserving the number. That's why it appears in many standard libraries:

Go: http.StatusTeapot
Python 3.9+: HTTPStatus.IM_A_TEAPOT
Node.js: http.STATUS_CODES[418] is "I'm a Teapot"

Where you'll see it

Easter eggs, such as Google's old teapot page and plenty of personal sites.
Bot blocking. Some sites and firewall rules answer scrapers and suspicious clients with 418 as a deliberately unhelpful refusal. If your script gets 418 from a real site, you were probably identified as a bot; read the site's terms and API options rather than retrying.
Test suites that need an unusual code nothing else returns.

Should you use it?

Not in anything real. Clients, monitoring and proxies don't know what 418 means beyond "some 4xx", so it says nothing useful. Pick the code that describes the actual problem:

refused access: 403 Forbidden
rate-limited client: 429 Too Many Requests
invalid input: 400 Bad Request or 422 Unprocessable Content

418 and SEO

Googlebot treats 418 as an ordinary 4xx error: the URL isn't indexed, and an indexed page answering 418 drops out of search. A bot rule that hits Googlebot with 418 removes your pages from Google, so check firewall rules if pages vanish. A hidden teapot page on its own does no harm.

403 Forbidden: the honest code for "we won't serve you".
429 Too Many Requests: slowing down a client that sends too much.
501 Not Implemented: the server doesn't support the method, a BREW for instance.

Curious whether a URL really answers 418? Send it a request with the HTTP Request Builder or check its redirects with the Redirect Checker.