diff --git a/src/http_ana.c b/src/http_ana.c
index e63323b..983c5eb 100644
--- a/src/http_ana.c
+++ b/src/http_ana.c
@@ -515,6 +515,9 @@
 
 		case HTTP_RULE_RES_BADREQ: /* failed with a bad request */
 			goto return_bad_req;
+
+		case HTTP_RULE_RES_ERROR: /* failed with a bad request */
+			goto return_int_err;
 		}
 	}
 
@@ -554,6 +557,12 @@
 
 		if (verdict == HTTP_RULE_RES_ABRT) /* stats auth / stats http-request auth */
 			goto return_prx_cond;
+
+		if (verdict == HTTP_RULE_RES_BADREQ) /* failed with a bad request */
+			goto return_bad_req;
+
+		if (verdict == HTTP_RULE_RES_ERROR) /* failed with a bad request */
+			goto return_int_err;
 	}
 
 	/* Proceed with the applets now. */
@@ -1931,19 +1940,31 @@
 		if (ret == HTTP_RULE_RES_CONT) {
 			ret = http_res_get_intercept_rule(cur_proxy, &cur_proxy->http_res_rules, s);
 
-				goto return_bad_res;
+			switch (ret) {
+			case HTTP_RULE_RES_YIELD: /* some data miss, call the function later. */
+				goto return_prx_yield;
+
+			case HTTP_RULE_RES_CONT:
+			case HTTP_RULE_RES_STOP: /* nothing to do */
+				break;
+
+			case HTTP_RULE_RES_DENY: /* deny or tarpit */
+				goto deny;
 
-			if (ret == HTTP_RULE_RES_DONE)
+			case HTTP_RULE_RES_ABRT: /* abort request, response already sent */
+				goto return_prx_cond;
+
+			case HTTP_RULE_RES_DONE: /* OK, but terminate request processing (eg: redirect) */
 				goto done;
-		}
 
-		/* we need to be called again. */
-		if (ret == HTTP_RULE_RES_YIELD)
-			goto return_prx_yield;
+			case HTTP_RULE_RES_BADREQ: /* failed with a bad request */
+				goto return_bad_res;
 
-		/* has the response been denied ? */
-		if (txn->flags & TX_SVDENY)
-			goto deny;
+			case HTTP_RULE_RES_ERROR: /* failed with a bad request */
+				goto return_int_err;
+			}
+
+		}
 
 		/* check whether we're already working on the frontend */
 		if (cur_proxy == sess->fe)
@@ -2929,14 +2950,14 @@
 				 */
 				rule_ret = HTTP_RULE_RES_ABRT;
 				if (http_reply_40x_unauthorized(s, auth_realm) == -1)
-					rule_ret = HTTP_RULE_RES_BADREQ;
+					rule_ret = HTTP_RULE_RES_ERROR;
 				stream_inc_http_err_ctr(s);
 				goto end;
 
 			case ACT_HTTP_REDIR:
 				rule_ret = HTTP_RULE_RES_DONE;
 				if (!http_apply_redirect_rule(rule->arg.redir, s, txn))
-					rule_ret = HTTP_RULE_RES_BADREQ;
+					rule_ret = HTTP_RULE_RES_ERROR;
 				goto end;
 
 			case ACT_HTTP_SET_NICE:
@@ -2961,7 +2982,7 @@
 							  ist2(rule->arg.hdr_add.name, rule->arg.hdr_add.name_len),
 							  &rule->arg.hdr_add.fmt,
 							  rule->arg.hdr_add.re, rule->action)) {
-					rule_ret = HTTP_RULE_RES_BADREQ;
+					rule_ret = HTTP_RULE_RES_ERROR;
 					goto end;
 				}
 				break;
@@ -2986,7 +3007,9 @@
 
 				replace = alloc_trash_chunk();
 				if (!replace) {
-					rule_ret = HTTP_RULE_RES_BADREQ;
+					if (!(s->flags & SF_ERR_MASK))
+						s->flags |= SF_ERR_RESOURCE;
+					rule_ret = HTTP_RULE_RES_ERROR;
 					goto end;
 				}
 
@@ -3031,7 +3054,9 @@
 				/* allocate key */
 				key = alloc_trash_chunk();
 				if (!key) {
-					rule_ret = HTTP_RULE_RES_BADREQ;
+					if (!(s->flags & SF_ERR_MASK))
+						s->flags |= SF_ERR_RESOURCE;
+					rule_ret = HTTP_RULE_RES_ERROR;
 					goto end;
 				}
 
@@ -3061,7 +3086,9 @@
 				/* allocate key */
 				key = alloc_trash_chunk();
 				if (!key) {
-					rule_ret = HTTP_RULE_RES_BADREQ;
+					if (!(s->flags & SF_ERR_MASK))
+						s->flags |= SF_ERR_RESOURCE;
+					rule_ret = HTTP_RULE_RES_ERROR;
 					goto end;
 				}
 
@@ -3092,7 +3119,9 @@
 				/* allocate key */
 				key = alloc_trash_chunk();
 				if (!key) {
-					rule_ret = HTTP_RULE_RES_BADREQ;
+					if (!(s->flags & SF_ERR_MASK))
+						s->flags |= SF_ERR_RESOURCE;
+					rule_ret = HTTP_RULE_RES_ERROR;
 					goto end;
 				}
 
@@ -3100,7 +3129,9 @@
 				value = alloc_trash_chunk();
 				if (!value) {
 					free_trash_chunk(key);
-					rule_ret = HTTP_RULE_RES_BADREQ;
+					if (!(s->flags & SF_ERR_MASK))
+						s->flags |= SF_ERR_RESOURCE;
+					rule_ret = HTTP_RULE_RES_ERROR;
 					goto end;
 				}
 
@@ -3133,7 +3164,7 @@
 									 ist2(rule->arg.early_hint.name, rule->arg.early_hint.name_len),
 									 &rule->arg.early_hint.fmt);
 				if (early_hints == -1) {
-					rule_ret = HTTP_RULE_RES_BADREQ;
+					rule_ret = HTTP_RULE_RES_ERROR;
 					goto end;
 				}
 				break;
@@ -3146,7 +3177,7 @@
 
 				switch (rule->action_ptr(rule, px, s->sess, s, act_flags)) {
 					case ACT_RET_ERR:
-						rule_ret = HTTP_RULE_RES_BADREQ;
+						rule_ret = HTTP_RULE_RES_ERROR;
 						goto end;
 					case ACT_RET_CONT:
 						break;
@@ -3216,7 +3247,7 @@
   end:
 	if (early_hints) {
 		if (http_reply_103_early_hints(&s->res) == -1)
-			rule_ret = HTTP_RULE_RES_BADREQ;
+			rule_ret = HTTP_RULE_RES_ERROR;
 	}
 
 	/* we reached the end of the rules, nothing to report */
@@ -3282,8 +3313,7 @@
 				goto end;
 
 			case ACT_ACTION_DENY:
-				txn->flags |= TX_SVDENY;
-				rule_ret = HTTP_RULE_RES_STOP;
+				rule_ret = HTTP_RULE_RES_DENY;
 				goto end;
 
 			case ACT_HTTP_SET_NICE:
@@ -3308,7 +3338,7 @@
 							  ist2(rule->arg.hdr_add.name, rule->arg.hdr_add.name_len),
 							  &rule->arg.hdr_add.fmt,
 							  rule->arg.hdr_add.re, rule->action)) {
-					rule_ret = HTTP_RULE_RES_BADREQ;
+					rule_ret = HTTP_RULE_RES_ERROR;
 					goto end;
 				}
 				break;
@@ -3327,7 +3357,9 @@
 
 				replace = alloc_trash_chunk();
 				if (!replace) {
-					rule_ret = HTTP_RULE_RES_BADREQ;
+					if (!(s->flags & SF_ERR_MASK))
+						s->flags |= SF_ERR_RESOURCE;
+					rule_ret = HTTP_RULE_RES_ERROR;
 					goto end;
 				}
 
@@ -3374,7 +3406,9 @@
 			/* allocate key */
 				key = alloc_trash_chunk();
 				if (!key) {
-					rule_ret = HTTP_RULE_RES_BADREQ;
+					if (!(s->flags & SF_ERR_MASK))
+						s->flags |= SF_ERR_RESOURCE;
+					rule_ret = HTTP_RULE_RES_ERROR;
 					goto end;
 				}
 
@@ -3404,7 +3438,9 @@
 				/* allocate key */
 				key = alloc_trash_chunk();
 				if (!key) {
-					rule_ret = HTTP_RULE_RES_BADREQ;
+					if (!(s->flags & SF_ERR_MASK))
+						s->flags |= SF_ERR_RESOURCE;
+					rule_ret = HTTP_RULE_RES_ERROR;
 					goto end;
 				}
 
@@ -3434,7 +3470,9 @@
 				/* allocate key */
 				key = alloc_trash_chunk();
 				if (!key) {
-					rule_ret = HTTP_RULE_RES_BADREQ;
+					if (!(s->flags & SF_ERR_MASK))
+						s->flags |= SF_ERR_RESOURCE;
+					rule_ret = HTTP_RULE_RES_ERROR;
 					goto end;
 				}
 
@@ -3442,7 +3480,9 @@
 				value = alloc_trash_chunk();
 				if (!value) {
 					free_trash_chunk(key);
-					rule_ret = HTTP_RULE_RES_BADREQ;
+					if (!(s->flags & SF_ERR_MASK))
+						s->flags |= SF_ERR_RESOURCE;
+					rule_ret = HTTP_RULE_RES_ERROR;
 					goto end;
 				}
 
@@ -3471,7 +3511,7 @@
 			case ACT_HTTP_REDIR:
 				rule_ret = HTTP_RULE_RES_DONE;
 				if (!http_apply_redirect_rule(rule->arg.redir, s, txn))
-					rule_ret = HTTP_RULE_RES_BADREQ;
+					rule_ret = HTTP_RULE_RES_ERROR;
 				goto end;
 
 			case ACT_ACTION_TRK_SC0 ... ACT_ACTION_TRK_SCMAX:
@@ -3541,7 +3581,7 @@
 
 				switch (rule->action_ptr(rule, px, s->sess, s, act_flags)) {
 					case ACT_RET_ERR:
-						rule_ret = HTTP_RULE_RES_BADREQ;
+						rule_ret = HTTP_RULE_RES_ERROR;
 						goto end;
 					case ACT_RET_CONT:
 						break;