HTTP status code

An HTTP status code is the three-digit number that a server places at the start of every HTTP response to state the outcome of the request: success, redirection, a client error or a server error. Among Internet protocols, it is the primary signal that browsers, crawlers, API clients, proxies and caches use to decide what to do next with a response, independent of the content that follows.

Status codes are defined in RFC 9110, the current HTTP semantics specification, and are shared by HTTP/1.1, HTTP/2 and HTTP/3. The best-known example is 404 Not Found, so familiar that “404 error” has become a synonym for a missing page. Each code comes with a short reason phrase in HTTP/1.1, but only the number carries meaning for software, and HTTP/2 and HTTP/3 drop the phrase entirely.

How the five HTTP status code classes work

The first digit defines the class of the response, and the remaining two digits refine it. This design means that a client which does not recognize a specific code can still treat it as the generic x00 code of its class, so an unknown 299 is handled like 200 and an unknown 499 like 400.

The status line appears before any HTTP header or body, so intermediaries such as load balancers, CDNs and monitoring systems can classify traffic without parsing the content. In HTTP/2 and HTTP/3, the code travels as the pseudo-header :status.

The status codes that matter most in practice

The IANA registry lists around sixty codes, but a small core set covers most real traffic. The table below summarizes the codes that web developers, administrators and API designers meet daily.

The naming of 401 Unauthorized is historically misleading: it actually means unauthenticated, and the response must include a WWW-Authenticate header. 403 Forbidden means the server knows who the client is but refuses access anyway.

Choosing the right redirect code

Redirect codes differ in two independent properties: whether the move is permanent and whether the client may change the request method. Choosing wrongly can turn a form submission into a plain GET or make search engines keep an outdated URL.

For website migrations, 301 or 308 tells search engines to transfer indexing to the new URL. Browsers cache permanent redirects aggressively, sometimes indefinitely, so a mistaken 301 can be hard to undo for visitors who already received it.

Status codes in APIs, caching and search

In REST and JSON APIs, status codes form part of the contract between server and client. A frequent design flaw is returning 200 OK with an error message in the body, which hides failures from monitoring tools, retry logic and caches that rely on the code.

Caches treat codes differently: responses such as 200, 301, 404 and 410 are heuristically cacheable, while others need explicit freshness headers. Search crawlers also react to codes: 404 and 410 remove pages from the index over time, repeated 5xx errors slow down crawling, and a soft 404, an error page served with 200, wastes crawl budget and confuses indexing.

• Use 422 or 400 for validation errors, with a structured body describing the problem.
• Add Retry-After to 429 and 503 so clients know when to try again.
• Return 410 Gone when a resource is removed deliberately and will not return.
• Keep 500 for unexpected faults, not for predictable conditions the client caused.

Common misreadings of HTTP status codes

Several errors in diagnosis come from attributing a code to the wrong component. A 502 Bad Gateway or 504 Gateway Timeout is produced by a proxy or load balancer, which reports that the upstream application failed or did not answer in time; the application itself may never have logged the request.

Unofficial codes add to the confusion. Some servers and CDNs use nonstandard values such as 444, 499 or 520 for internal conditions; they are not part of the HTTP standard and should be interpreted using the documentation of the product that produced them.

A non-technical view

Every time a browser asks a website for a page, the website answers with a short number before anything else. That number is the HTTP status code. It works like the stamp a post office puts on a returned letter. One stamp means delivered. Another means moved to a new address. Another means nobody lives here.

The famous 404 means the page was not found. Numbers starting with 2 mean everything went well. Numbers starting with 5 mean the website itself had a problem. People rarely see these numbers, but programs read them constantly to decide what to do next.

A concrete example

An online magazine moves from old-magazine.example to a new domain and restructures its article URLs. The developers map every old address to its new one and return 301 Moved Permanently for each. Pages that were deliberately removed get 410 Gone, and the editorial search page answers with 303 See Other after a form submission.

In the first week after the switch, the monitoring dashboard shows a rise in 504 responses from the load balancer. Investigation reveals that a new image-processing service takes up to 70 seconds, while the proxy timeout is 60 seconds. After moving image processing to a background queue, the 504s disappear. Search engines transfer the old rankings to the new URLs within a few weeks, and readers following old links reach the right articles.