What status code should I return for a non AJAX request to an AJAX only URL?

Question

If the URL is requested not using AJAX what status code should be returned? 400?

Answer 1

I think 403 Forbidden ist best.

501 Not Implemented does not fit well, because the resource is implemented, but just not suited for that kind of request.

400 Bad Request ist not a good choice either, because this implies, according to the spec, that "the request could not be understood by the server due to malformed syntax", which is not the case here.