Status 0: no response at all
A status of 0 means the browser never received an HTTP response. The server did not say no; nothing came back that the page was allowed to see. The usual causes are a CORS block, an ad or privacy blocker (Chrome records net::ERR_BLOCKED_BY_CLIENT), a content security policy, the request being cancelled because the user navigated away, or a DNS or connection failure. The HAR's error text, when present, narrows it down.
CORS
When a page on one origin calls an API on another, the API must return an Access-Control-Allow-Origin header that matches the page, and for anything beyond a simple request it must first answer a preflight OPTIONS request. In a HAR, a CORS problem looks like one of these:
- An
OPTIONSrequest withAccess-Control-Request-Methodthat got a 4xx or 5xx. The real request is never sent. - A cross-origin request with status 0.
- A successful cross-origin response with no
Access-Control-Allow-Origin, or one naming a different origin. The server answered; the browser hid the answer from the page. Access-Control-Allow-Origin: *together withAccess-Control-Allow-Credentials: true, which browsers refuse for requests sent with cookies.
CORS is always fixed on the server being called, not in the page. HARscope labels these as likely: the console message in the browser names the exact rule that failed.
401 and 403
401 Unauthorized means the request carried no valid credentials: the session cookie is missing or expired, or the token is wrong. 403 Forbidden means the server knew who was asking and refused, or a firewall in front of it did. If 401s start right after a sign-in, look at the sign-in response's Set-Cookie: a cookie with the wrong domain, or one the browser rejects, gives exactly that pattern.
Cookies the browser throws away
A Set-Cookie with SameSite=None but no Secure is rejected by Chrome and Edge. Cookies named __Secure-… or __Host-… must meet their prefix rules or they are dropped. The HAR still shows the header, so the server looks fine while the browser quietly signs you out. The Cookies tab lists every cookie set, with its flags and any problem.
5xx server errors
A 500 means the application failed while handling the request; its logs at that timestamp say why, and the HAR gives you the exact time and often a request ID in the response headers or body. 502, 503 and 504 usually come from a proxy or load balancer that could not reach the application or gave up waiting.
Redirects
One redirect is normal: http to https, or to a sign-in page. A chain of several costs a round trip each before anything loads. A loop, where the browser is sent back to a URL it already visited, is usually a sign-in rule and an https or www rule disagreeing. HARscope follows Location headers through the file to find chains and loops.
Mixed content
An https page that loads anything over plain http:// has mixed content. Browsers block scripts, styles, frames and API calls like that, and upgrade or block images and media. The fix is the URL, not the server.
Slow, large and uncompressed
- Slow TTFB: a long wait for the first byte is server time. HARscope flags waits over 600 ms.
- Large payloads: images over 500 kB and other responses over 1 MB.
- No compression: HTML, CSS, JavaScript or JSON over 20 kB with no
Content-Encoding. Text typically shrinks by well over half with gzip or Brotli. - Repeated requests: the same URL fetched three or more times, which is either polling or a bug.
Before sharing the file
If you are sending the HAR to someone else to diagnose, sanitize it first. The status codes, timings and header names they need all survive redaction.
Related: HAR waterfall timings, explained · Sanitize a HAR file before you share it