425 Too Early

Client error: the problem lies with the request. Repeating it unchanged will normally fail again.

When a server should send it. When a request arrived in TLS 1.3 early data (0-RTT) and processing it could be unsafe if an attacker replayed it. Servers or CDNs that accept early data send it for requests that are not safe to repeat.

Common causes. TLS 1.3 early data sent before the handshake completed.

What to do. Retry after the connection is fully set up; clients usually do this automatically.

Browsers and HTTP clients. Browsers that sent the request in early data retry it automatically once the TLS handshake completes, so users do not see it.

Google Search. Like every 4xx except 429, it tells Google the content does not exist: an indexed URL is removed from the index, and a new one is not processed. Crawl frequency for the URL gradually drops. Source: Google Search Central, How HTTP status codes, and network and DNS errors affect Google Search.

Caching. Not cacheable by default (RFC 9110 section 15.1 does not list it). A cache stores it only when the response says so with Cache-Control or Expires.

HTTP/1.1 425 Too Early
Content-Type: text/plain; charset=utf-8

Too Early

location /example {
    return 425;
}

RewriteEngine On
RewriteRule ^example$ - [R=425,L]

http_response_code(425);
echo 'Too Early';
exit;

res.writeHead(425, { 'Content-Type': 'text/plain' });
res.end('Too Early');

# in a view function
return 'Too Early', 425