Every HTTP response starts with a three-digit status code that tells the browser, search engines and caches what happened. Knowing what each code means on a web server, and which layer produced it, is the fastest way to diagnose a broken page. This reference covers the codes you will actually meet.
Before you start
- Check a URL's code with
curl -sI https://example.com/pageor the browser's DevTools Network tab. - Background on requests and responses: HTTP requests and responses explained.
The five classes
| Class | Meaning |
|---|---|
| 1xx | Informational: request received, continue |
| 2xx | Success |
| 3xx | Redirection: look elsewhere or use your cached copy |
| 4xx | Client error: the request was wrong or not allowed |
| 5xx | Server error: the server failed to fulfil a valid request |
2xx success codes
- 200 OK: normal success.
- 201 Created: an API created something (after POST).
- 204 No Content: success with an empty body, common for APIs and CORS preflights.
- 206 Partial Content: a range of a file, used for video seeking and resumable downloads.
3xx redirect codes
| Code | Meaning | SEO effect |
|---|---|---|
| 301 | Moved permanently | Passes ranking signals to the new URL; cached by browsers |
| 302 | Found (temporary) | Original URL stays indexed |
| 304 | Not Modified | No body; browser reuses its cached copy |
| 307 | Temporary, method kept | Like 302 but POST stays POST |
| 308 | Permanent, method kept | Like 301 but POST stays POST |
Too many redirects in a chain, or a loop, end in a browser error. See fix too many redirects.
4xx client error codes
- 400 Bad Request: malformed request, oversized cookies or headers.
- 401 Unauthorized: login required (HTTP auth or API token missing).
- 403 Forbidden: the server refuses: file permissions,
Require all denied, an IP block, or a WAF/ModSecurity rule. - 404 Not Found: no file or route for that URL. Check the path, rewrite rules and that the document root is right.
- 405 Method Not Allowed: e.g. POST to a URL that only accepts GET.
- 408 Request Timeout: the client was too slow sending the request.
- 410 Gone: removed on purpose; search engines drop it faster than a 404.
- 413 Content Too Large: upload above
client_max_body_sizeorLimitRequestBody. See fix 413 errors. - 414 URI Too Long: giant query strings, often from redirect loops appending parameters.
- 429 Too Many Requests: rate limiting kicked in (Nginx rate limiting).
5xx server error codes
| Code | Typical cause | Where to look |
|---|---|---|
| 500 Internal Server Error | PHP fatal error, broken .htaccess, bad permissions | Site error log, PHP error log |
| 502 Bad Gateway | PHP-FPM or backend crashed, wrong socket, not running | Web server error log, systemctl status php-fpm |
| 503 Service Unavailable | Overloaded, maintenance, resource limits reached, app pool stopped | Server load, LiteSpeed/CloudLinux limits |
| 504 Gateway Timeout | Backend too slow; proxy timeout reached | Slow log, timeouts (timeout tuning) |
| 508 Resource Limit Reached | CloudLinux entry-process limit on shared hosting | cPanel → Resource Usage |
Which layer produced the error?
- Look at the
Serverheader and the page style: a Cloudflare-branded page means the CDN generated it (and the origin may be the problem behind it). - A plain Nginx/Apache/LiteSpeed page usually means the web server itself or its backend failed.
- A themed page from your CMS means the app is running and returned the code itself.
Status codes and SEO
- Use 301 for moved pages and 410 for content deleted for good.
- Never return 200 for "page not found" content (a soft 404).
- During maintenance return 503 with
Retry-After, not 200 or 404. See custom error pages. - Many 5xx errors over days can make search engines crawl less and drop pages.
FAQ: HTTP status codes
What is the difference between 401 and 403?
401 means "log in first"; 403 means "you are not allowed, even if logged in".
Is a 304 an error?
No. It saves bandwidth by telling the browser its cached copy is still valid.
Why do I get 503 only at busy times?
The site hits worker or resource limits. Add caching or more resources.