HTTP status codes explained — the ones you'll actually meet, and what to do about them

Every response from a web server begins with a three-digit number that says how the request went. Most people know 404; developers, SEOs and anyone who runs a website need a dozen more, because the difference between a 301 and a 302, or a 404 and a 410, changes what browsers, caches and search engines do next. The status code reference lists them all; this guide covers the ones that come up.

Five classes

The first digit is the class: 1xx informational (rare: 101 Switching Protocols for WebSockets), 2xx success, 3xx redirection (look elsewhere), 4xx client error (the request was wrong), 5xx server error (the request was fine; the server failed). Unknown codes are treated as their class's generic member, which is why inventing a 799 is harmless and pointless.

2xx and 3xx: success and redirects

• 200 OK — here's the thing you asked for. 201 Created after a POST that made something; 204 No Content for success with nothing to return.
• 301 Moved Permanently — the resource lives at the new URL from now on. Browsers cache it; search engines transfer ranking signals. The right code when a slug or domain changes (What a URL slug is, and the rules for a clean one).
• 302 Found (and 307) — temporary redirect; keep using the old URL later. For A/B tests, maintenance detours, geographic routing. Search engines keep the original indexed.
• 308 — permanent like 301 but preserves the request method (a POST stays a POST), which 301 historically didn't guarantee.
• 304 Not Modified — the cached copy is still good; the body is empty. The reason a repeat visit is fast.

4xx: the client's problem

• 400 Bad Request — malformed request; a syntax error in what was sent.
• 401 Unauthorized — you need to log in (it really means unauthenticated). 403 Forbidden — you're identified and still not allowed.
• 404 Not Found — no such resource. 410 Gone — it existed and was deliberately removed; search engines drop 410s faster than 404s.
• 405 Method Not Allowed — right URL, wrong verb (a GET to a POST-only endpoint).
• 408 / 409 / 413 — timeout, conflict (editing a stale version), payload too large (the upload limit).
• 429 Too Many Requests — rate-limited; back off, usually with a Retry-After header.
• 451 Unavailable For Legal Reasons — blocked by law (the number is a Bradbury reference).

5xx: the server's problem

• 500 Internal Server Error — the application crashed; the generic failure.
• 502 Bad Gateway — a proxy or load balancer couldn't get a valid response from the server behind it; usually the app is down or restarting.
• 503 Service Unavailable — overloaded or in maintenance; the correct code for planned downtime, with Retry-After so crawlers come back rather than de-indexing.
• 504 Gateway Timeout — the upstream took too long.

The codes that matter for SEO

Search engines follow 301/308 and pass signals; 302/307 keeps the old URL indexed, so a "temporary" redirect left in place for years splits signals between two addresses. A 404 for a page that has links pointing at it wastes those links — redirect it to the closest equivalent. 410 tells crawlers to drop a page quickly. A soft 404 (a "not found" page that returns 200) is worse than a real one: it gets indexed as content. During downtime, 503 with Retry-After preserves rankings where a 500 or a 200 error page does not. And a redirect chain (301 → 301 → 200) slows users and dilutes signals; point old URLs at the final destination. The URL parser takes a link apart; the sitemap generator should list only URLs that return 200.