Gone
ActiveHTTP 410 Gone indicates the target resource is no longer available at the origin server and this condition is likely to be permanent. Defined in RFC 9110 §15.5.11. Unlike 404, which implies the resource might return, 410 is a definitive signal that the resource has been intentionally and permanently removed. Cacheable by default.
Description
The 410 Gone status code indicates that access to the target resource is no longer available at the origin server and that this condition is likely to be permanent. If the origin server does not know, or has no facility to determine, whether the condition is permanent, 404 Not Found should be used instead.
The critical distinction between 410 and 404: a 404 means the server cannot find the resource right now — it might come back, the URL might be wrong, or the resource might never have existed. A 410 is an explicit, intentional declaration: this resource existed, we know about it, and we deliberately removed it with no intention of bringing it back. It's a tombstone, not a mystery.
For SEO, this distinction matters significantly. Search engines treat 410 as a stronger deindexing signal than 404. Google has confirmed that 410 pages are removed from the index faster than 404 pages. If you want content purged from search results quickly — deleted blog posts, expired promotions, removed user profiles — 410 is the correct response. Returning 404 for intentionally deleted content leaves the URL in a limbo state where crawlers keep checking back.
The 410 response is cacheable by default. A client that receives a 410 SHOULD remove any stored references to the target URI. The server SHOULD NOT include a Location header — unlike 301 which redirects to a new location, 410 explicitly signals there IS no replacement. If a replacement exists, use 301 or 308 instead.
The response body SHOULD contain a short description of the situation, optionally with links to related resources or an explanation of why the content was removed. Some implementations include a pointer to a parent resource or archive page, though this is courtesy rather than protocol requirement.
Examples
GET /blog/2023/black-friday-deals HTTP/1.1
Host: www.example.com
Accept: text/htmlHTTP/1.1 410 Gone
Content-Type: application/json
Cache-Control: public, max-age=86400
{"error": "gone", "message": "This blog post has been permanently removed.", "removed_at": "2024-01-15T00:00:00Z", "reason": "Content no longer relevant.", "alternatives": ["/blog/2024/new-year-deals"]}GET /api/v1/users/42/timeline HTTP/1.1
Host: api.example.com
Authorization: Bearer token123
Accept: application/jsonHTTP/1.1 410 Gone
Content-Type: application/json
Sunset: Sat, 01 Jan 2024 00:00:00 GMT
Link: </api/v3/users/42/feed>; rel="successor-version"
{"error": "endpoint_gone", "message": "API v1 was permanently shut down on 2024-01-01. Migrate to v3.", "migration_guide": "https://docs.example.com/migration/v1-to-v3", "sunset_date": "2024-01-01"}GET /users/alice-smith HTTP/1.1
Host: www.example.com
Accept: text/htmlHTTP/1.1 410 Gone
Content-Type: application/json
Cache-Control: public, max-age=604800
{"error": "gone", "message": "This user account has been permanently deleted at the account holder's request.", "removed_at": "2024-02-10T14:30:00Z"}Edge Cases
- •410 should ONLY be used when you are confident the removal is permanent. If there's any chance the resource will return (maintenance, temporary takedown, seasonal content), use 404 instead.
- •Do NOT include a Location header in a 410 response. If a replacement exists at a different URL, the correct response is 301 (Moved Permanently) or 308 (Permanent Redirect) — not 410 with a redirect hint.
- •For GDPR right-to-erasure (Article 17): 410 is the appropriate response for deleted user profiles. However, the response body must not leak any personal data about the deleted user — just confirm the resource is gone.
- •Search engines (Google, Bing) deindex 410 URLs faster than 404 URLs. Use this strategically when you want content purged from search results quickly — but be aware this is effectively irreversible from an SEO perspective.
- •Some CDNs and reverse proxies cache 410 responses aggressively because they're cacheable by default. If you accidentally return 410 for a resource that should still exist, the cached tombstone can persist across edge nodes. Always double-check before deploying 410 logic.
- •API deprecation: don't jump from 200 to 410. Use the Sunset header with deprecation warnings first, then switch to 410 after the sunset date. This gives clients time to migrate.
- •Soft-deleted resources present a design choice: return 410 (permanent to the outside world) or 404 (pretend it never existed). 410 is more honest — it acknowledges the resource existed. 404 offers more privacy.
When You'll See This
- →Blog post permanently deleted by the author (not unpublished — deleted)
- →User account erased under GDPR right-to-erasure request
- →Expired promotional landing page that will never return (Black Friday 2022)
- →Sunset API version after migration period ends (v1 shut down, v3 active)
- →Product listing removed from a catalog because the item is discontinued
- →Social media post deleted by the user or removed by moderation
- →Deprecated webhook endpoint that clients should stop calling
- →Removed documentation page for a feature that was killed
Implementation References
| Language | Constant |
|---|---|
| Go | http.StatusGone |
| Rust | http::StatusCode::GONE |
| Python | http.HTTPStatus.GONE |
| Node.js | http.STATUS_CODES[410] |
| .NET | HttpStatusCode.Gone |
| Java | HttpURLConnection.HTTP_GONE |
| PHP | Response::HTTP_GONE (Symfony) |
| Ruby | :gone (Rack) |
History
Introduced in HTTP/1.1 (RFC 2068, 1997) alongside most 4xx codes. Refined in RFC 2616 (1999) and consolidated into RFC 9110 (2022) §15.5.11. Originally designed for cases where server administrators intentionally remove content and want to inform both clients and link maintainers that the resource should be dereferenced. Gained renewed importance with GDPR (2018) for signaling permanently erased user data, and with API lifecycle management for indicating sunset endpoints.
Related Status Codes
Related Headers
FAQ
What is the difference between 410 Gone and 404 Not Found?
404 means the server can't find the resource — it might never have existed, the URL might be wrong, or it might come back later. 410 is a deliberate declaration: this resource existed, we know about it, and we permanently removed it. The practical difference for search engines is significant — Google deindexes 410 pages faster than 404 pages because 410 is an unambiguous signal that recrawling is pointless.
Should I use 410 for GDPR deletion requests?
Yes. When a user exercises their right to erasure (GDPR Article 17), responding with 410 to subsequent requests for their profile or content is the semantically correct approach. It confirms the data existed and was deliberately erased without revealing any personal information about the deleted user. Be careful that your 410 response body doesn't leak any personal data — just acknowledge the resource is gone.
Is a 410 response cacheable?
Yes, 410 is cacheable by default per RFC 9110. Clients and intermediaries MAY cache the response unless cache directives indicate otherwise. This is intentional — once a resource is declared permanently gone, there's no reason for clients or proxies to keep checking. You can control cache duration with Cache-Control headers, but the default behavior is to cache aggressively.