HTTP 421 Misdirected Request explained

The symptom

A request returns 421 Misdirected Request. The connection went through, but the server refuses to answer because the request was directed at the wrong host: the Host header does not match the target the connection was established for, or the server cannot connect the request to the correct site on a shared connection.

What 421 means

421 Misdirected Request is defined in the HTTP/2 and HTTP/1.1 specifications as the status a server returns when a request is made to a connection that cannot produce a response for the target given. It is not a general "cannot find this page" error (that is 404) and not a malformed request (that is 400). It specifically signals that the request has been misdirected to the wrong host or connection.

It is commonly seen in these situations:

• HTTP/2 connections reusing a connection that was negotiated for one host to request another host.
• A Host header that does not match the certificate or vhost the connection was established with.
• A server that could not determine which site on a shared connection should answer.

Fix the request

A client-triggered 421 usually comes from a request targeting a connection that was built for a different site:

1. Check that the URL's Host header matches the intended site and the certificate served on that connection.
2. Move a request for a second hostname onto its own connection instead of reusing one negotiated for the first. HTTP/2 clients do this automatically when the Host differs, but a misconfigured client pool can fail to.
3. Verify there is no stale DNS or proxy layer rewriting the Host header to the wrong value before it reaches the server.

If an intermediary (a load balancer or reverse proxy) forwards requests, make sure it forwards the original Host and does not rewrite it unconditionally.

Fix the server side

On a server that serves multiple sites, all hostnames that share a connection or certificate must be able to resolve to the correct vhost. A request can only be routed to the right site if the server knows that host:

• Add the hostname to the server, and if it is served on the same TLS connection, cover it with a certificate that includes it, such as a SAN certificate covering several domains (see the SAN guide).
• Do not answer a bare, unknown hostname with 421 unless that is the deliberate behaviour; typically you want either a correct vhost or a clean redirect to the intended hostname.

Prevention and related statuses

Because 421 commonly coexists with HTTPS and shared hosting, review how the certificate and the host configuration map to each other. The SSL and HTTPS impact guide and the 400 Bad Request guide help distinguish a misdirection from a malformed request when a change is deployed. Keep connections and hostnames aligned, and 421 becomes a rare signal instead of a recurring mystery.