HTTP status codes

Every HTTP response starts with a three-digit status code that tells the client what happened. Choosing the right code makes APIs predictable, helps search engines index pages correctly and speeds up debugging. This reference lists the standard codes with their meanings.

The five classes

• 1xx Informational: request received, continuing (101 Switching Protocols for WebSockets).
• 2xx Success: 200 OK, 201 Created, 202 Accepted, 204 No Content.
• 3xx Redirection: 301, 302, 304, 307, 308.
• 4xx Client error: the request was wrong.
• 5xx Server error: the server failed to handle a valid request.

Codes that are often confused

• 301 vs 302 vs 307 vs 308: 301 and 308 are permanent; 302 and 307 are temporary. 307 and 308 guarantee the method and body are kept, so a POST stays a POST.
• 401 vs 403: 401 Unauthorized means not authenticated (log in); 403 Forbidden means authenticated but not allowed.
• 400 vs 422: 400 for malformed requests; 422 for well-formed requests that fail validation.
• 404 vs 410: 410 Gone tells search engines a page was removed permanently.
• 429 Too Many Requests: rate limit hit; send a Retry-After header.
• 500 vs 502 vs 503 vs 504: 500 is an application error; 502 means a gateway got an invalid response from upstream; 503 means temporarily unavailable or overloaded; 504 means the upstream did not respond in time.

SEO notes

• Use 301 or 308 for moved pages so ranking signals transfer.
• Return a real 404 for missing pages; a 200 page saying not found is a soft 404.
• Use 503 with Retry-After during maintenance so pages are not dropped from the index.