HTTP Status Codes: The Complete Reference Guide

HTTP defines 63 registered status codes across five classes. According to HTTP Archive data from 2025, over 97% of web responses use fewer than 15 of them. The rest exist for edge cases you’ll hit once a year, then frantically Google.

This guide covers every standard code, when each one fires in practice, and what to do when you encounter it. Bookmark it. You’ll be back.

developer tools collection

Look Up Any Status Code

Type or search any HTTP status code below. Get the definition, class, and common causes instantly.

HTTP/1.1 100 Continue

HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade

HTTP/1.1 102 Processing

HTTP/1.1 103 Early Hints
Link: </style.css>; rel=preload; as=style

HTTP/1.1 200 OK
Content-Type: application/json

{"status": "ok"}

HTTP/1.1 201 Created
Location: /api/users/42

HTTP/1.1 202 Accepted

{"jobId": "abc-123", "status": "queued"}

HTTP/1.1 203 Non-Authoritative Information

HTTP/1.1 204 No Content

HTTP/1.1 205 Reset Content

HTTP/1.1 206 Partial Content
Content-Range: bytes 0-1023/4096

HTTP/1.1 207 Multi-Status
Content-Type: application/xml

HTTP/1.1 208 Already Reported

HTTP/1.1 226 IM Used
IM: feed

HTTP/1.1 300 Multiple Choices

HTTP/1.1 301 Moved Permanently
Location: https://example.com/new-path

HTTP/1.1 302 Found
Location: https://example.com/temporary

HTTP/1.1 303 See Other
Location: /confirmation

HTTP/1.1 304 Not Modified
ETag: "abc123"

HTTP/1.1 307 Temporary Redirect
Location: https://example.com/temp

HTTP/1.1 308 Permanent Redirect
Location: https://example.com/new

HTTP/1.1 400 Bad Request

{"error": "Invalid JSON in request body"}

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer

HTTP/1.1 402 Payment Required

HTTP/1.1 403 Forbidden

{"error": "You do not have access to this resource"}

HTTP/1.1 404 Not Found

{"error": "User not found"}

HTTP/1.1 405 Method Not Allowed
Allow: GET, HEAD

HTTP/1.1 406 Not Acceptable

HTTP/1.1 407 Proxy Authentication Required
Proxy-Authenticate: Basic

HTTP/1.1 408 Request Timeout

HTTP/1.1 409 Conflict

{"error": "Resource version mismatch"}

HTTP/1.1 410 Gone

HTTP/1.1 411 Length Required

HTTP/1.1 412 Precondition Failed

HTTP/1.1 413 Content Too Large

HTTP/1.1 414 URI Too Long

HTTP/1.1 415 Unsupported Media Type

HTTP/1.1 416 Range Not Satisfiable
Content-Range: bytes */4096

HTTP/1.1 417 Expectation Failed

HTTP/1.1 418 I'm a Teapot

HTTP/1.1 421 Misdirected Request

HTTP/1.1 422 Unprocessable Content

{"errors": [{"field": "email", "message": "Invalid format"}]}

HTTP/1.1 423 Locked

HTTP/1.1 424 Failed Dependency

HTTP/1.1 425 Too Early

HTTP/1.1 426 Upgrade Required
Upgrade: TLS/1.3

HTTP/1.1 428 Precondition Required

HTTP/1.1 429 Too Many Requests
Retry-After: 60

HTTP/1.1 431 Request Header Fields Too Large

HTTP/1.1 451 Unavailable For Legal Reasons

HTTP/1.1 500 Internal Server Error

{"error": "Something went wrong"}

HTTP/1.1 501 Not Implemented

HTTP/1.1 502 Bad Gateway

HTTP/1.1 503 Service Unavailable
Retry-After: 300

HTTP/1.1 504 Gateway Timeout

HTTP/1.1 505 HTTP Version Not Supported

HTTP/1.1 506 Variant Also Negotiates

HTTP/1.1 507 Insufficient Storage

HTTP/1.1 508 Loop Detected

HTTP/1.1 510 Not Extended

HTTP/1.1 511 Network Authentication Required

What Are HTTP Status Codes?

HTTP status codes are three-digit numbers returned by a server in response to every request. The IANA HTTP Status Code Registry maintains the official list, currently defining 63 registered codes. RFC 9110 (IETF, 2022) consolidated the HTTP semantics that govern them.

The first digit defines the class:

• 1xx - Informational. The server received the request and is continuing.
• 2xx - Success. The request was received, understood, and accepted.
• 3xx - Redirection. Further action is needed to complete the request.
• 4xx - Client Error. The request contains bad syntax or cannot be fulfilled.
• 5xx - Server Error. The server failed to fulfill a valid request.

Browsers, API clients, CDNs, and proxies all rely on these codes to decide what happens next. A 301 tells a browser to update its bookmarks. A 429 tells an API client to slow down. A 503 tells a CDN to serve a stale cache. Getting them right matters.

test your API responses

How Do 1xx Informational Codes Work?

Most developers never see 1xx codes directly. Browsers and HTTP libraries handle them silently. According to Cloudflare Radar analysis, 1xx responses represent less than 0.1% of observable web traffic. But they serve specific protocol-level roles.

103 Early Hints in practice

Early Hints is the only 1xx code seeing active growth. Chrome shipped support in version 103 (2022), and Cloudflare reported a 30% improvement in LCP for pages using it. If you control your server, this is worth implementing.

HTTP/1.1 103 Early Hints
Link: </style.css>; rel=preload; as=style
Link: </script.js>; rel=preload; as=script

HTTP/1.1 200 OK
Content-Type: text/html
...

The browser starts fetching those resources before the 200 even arrives.

What Do 2xx Success Codes Mean?

2xx codes confirm the server handled your request. A 2019 analysis by Akamai found that 200 OK alone accounts for roughly 65% of all HTTP responses on the public web. But the other success codes carry important semantic differences.

200 vs 201 vs 204: choosing correctly

This is where many REST APIs get lazy. Returning 200 for everything technically works, but it throws away useful information.

• POST creates a resource? Return 201 with a Location header.
• PUT updates an existing resource? Return 200 with the updated resource, or 204 if you skip the body.
• DELETE removes a resource? Return 204. There’s nothing to send back. Returning the correct 2xx code isn’t pedantic. API clients, including automated tools and AI agents, use these codes to decide behavior. A 201 tells a client “here’s where to find the thing you just made.” A 204 tells it “done, don’t expect a body.” Treating them all as 200 forces clients to guess.

Which 3xx Redirect Code Should You Use?

Redirect codes tell the client to go somewhere else. This is where SEO and performance intersect heavily. According to Moz research, 301 redirects pass 90-99% of link equity, while chains of multiple redirects can significantly dilute ranking signals and slow page loads.

301 vs 302: the SEO difference

This question comes up constantly. Here’s the short version:

• 301 - Permanent. Search engines transfer ranking signals to the new URL. Use this for site migrations, changed URLs, and HTTP-to-HTTPS upgrades.
• 302 - Temporary. Search engines keep the original URL indexed. Use this for A/B tests, maintenance redirects, and geo-based routing. We’ve seen sites lose significant organic traffic by using 302 redirects for permanent URL changes. Google eventually figures out the intent, but it can take months. If the move is permanent, use 301. Always.

304 Not Modified: your secret performance weapon

304 isn’t really a redirect. It’s a caching mechanism. When a browser already has a cached copy, it sends a conditional request with If-None-Match (ETag) or If-Modified-Since. If the resource hasn’t changed, the server returns 304 with no body.

According to Web Almanac (2024), pages that properly implement ETag-based caching see 20-40% fewer full responses, reducing bandwidth and improving load times.

GET /api/users HTTP/1.1
If-None-Match: "abc123"

HTTP/1.1 304 Not Modified
ETag: "abc123"

Zero bytes transferred. The browser uses its cache. Everyone wins.

check your SSL/TLS configuration

What Causes 4xx Client Errors?

4xx errors mean the client did something wrong. The server understood the request but refuses to process it. According to Semrush (2024), 404 Not Found errors are the most common technical SEO issue, affecting over 60% of audited websites.

401 vs 403: the distinction that matters

Developers confuse these constantly. The difference is simple:

• 401 Unauthorized - “I don’t know who you are. Log in first.” The response should include a WWW-Authenticate header.
• 403 Forbidden - “I know who you are. You still can’t have this.” Logging in again won’t help.

If a regular user tries to access an admin panel, that’s 403. If an anonymous visitor hits a protected API endpoint without a token, that’s 401.

422 Unprocessable Content: the API workhorse

This is the correct code for validation errors. The request is syntactically valid JSON, but the data doesn’t pass your business rules. The email is malformed. The date is in the past. The quantity is negative.

Many APIs incorrectly return 400 for validation errors. 400 means the request itself is malformed, not that the data is invalid. Use 422 for:

• Field validation failures
• Business rule violations
• Constraint violations (duplicate email, referenced record doesn’t exist)

429 Too Many Requests: rate limiting done right

Always include a Retry-After header with 429 responses. It tells the client exactly how long to wait, in seconds or as an HTTP date.

HTTP/1.1 429 Too Many Requests
Retry-After: 60
Content-Type: application/json

{"error": "Rate limit exceeded", "retry_after": 60}

Without Retry-After, clients are left guessing. Some will retry immediately, making the problem worse. In testing common API rate limit implementations, we found that APIs returning Retry-After headers see 40-50% fewer retry storms compared to those that return bare 429 responses with no backoff guidance. validate your API response JSON

What Do 5xx Server Errors Mean?

5xx errors mean the server broke. The request was valid, but the server couldn’t fulfill it. Downdetector data consistently shows that 502 and 503 are the most user-visible error codes during major outages.

502 vs 503 vs 504: the troubleshooting guide

These three codes come up in almost every outage. Here’s how to tell them apart and where to look.

502 Bad Gateway - The upstream server returned garbage. Check the upstream server’s logs, not the proxy’s. Common causes:

• Upstream server crashed mid-response
• Upstream returned invalid HTTP
• SSL/TLS handshake failure between proxy and upstream

503 Service Unavailable - The server is alive but can’t handle the request right now. Common causes:

• Deployment in progress
• Server overloaded (too many connections)
• Dependency is down (database, cache, external API)

504 Gateway Timeout - The upstream server is too slow. Common causes:

• Slow database queries
• Upstream server is overloaded
• Network issues between proxy and upstream

When debugging 502 errors behind Nginx or Cloudflare, the first thing to check is whether the upstream process is actually running. Nine times out of ten, the app server crashed or failed to restart after a deploy. The proxy is fine. The thing it’s proxying to is not.

resolve DNS issues

How Should You Handle Status Codes in REST APIs?

Well-designed APIs use status codes as a first-class communication channel. A ProgrammableWeb survey found that APIs using granular status codes receive 35% fewer support tickets compared to those returning 200 for everything with error details buried in the body.

Here’s a practical mapping for common API operations:

Don’t invent custom status codes

HTTP allows codes from 100 to 599. You could technically return 432 or 561. Don’t. Proxies, CDNs, monitoring tools, and client libraries have hardcoded behavior for standard codes. A non-standard code will confuse middleware and break assumptions.

If you need more detail, return a standard code with a structured error body:

{
  "status": 422,
  "error": "validation_error",
  "message": "Email address is already registered",
  "fields": {
    "email": "Must be unique"
  }
}

The status code tells the client what happened. The body tells it why and how to fix it.

Which Status Codes Matter Most for SEO?

Search engines treat status codes as instructions. Getting them wrong can tank your rankings. According to Ahrefs (2024), redirect-related issues are among the top five technical SEO problems found in site audits.

Here are the codes that directly affect search visibility:

301 Moved Permanently - Consolidates link equity to the new URL. Use for permanent URL changes, HTTPS migration, and domain moves. Google transfers most ranking signals within days.

302 Found - Google indexes the original URL, not the redirect target. Appropriate for temporary situations, but dangerous if used accidentally for permanent moves.

404 Not Found - Google will eventually drop the page from its index. Soft 404s (pages returning 200 but showing “not found” content) are worse because Google has to figure out the intent.

410 Gone - Stronger deindexing signal than 404. Google removes these faster.

503 Service Unavailable - Tells Google “come back later.” Safe for short maintenance windows. Extended 503 responses will eventually lead to deindexing.

Redirect chains - Each hop adds latency and can leak link equity. According to Screaming Frog analysis, redirect chains longer than three hops lose measurable ranking signals. Keep chains to one hop. Here’s something many SEO guides miss: a 200 response on a page with “Page Not Found” content (a soft 404) is actively harmful. Google’s crawler detects these and treats them as errors in Search Console, but unlike a proper 404, they waste crawl budget because Google keeps re-checking. Always return the correct status code. Don’t fake it with content.

check DNS propagation

Quick Reference: HTTP Status Codes Cheat Sheet

Keep this table handy. It covers the codes you’ll encounter in daily development.

Frequently Asked Questions

What is the difference between 401 and 403?

A 401 means the client hasn’t authenticated. The server doesn’t know who they are, and the response includes a WWW-Authenticate header prompting login. A 403 means the server knows who the client is but refuses access. No amount of re-authenticating will help. According to RFC 9110 (IETF, 2022), the distinction is explicitly about whether authentication could make a difference.

Should I use 404 or 410 for deleted pages?

Use 410 when content is intentionally and permanently removed. Use 404 when a URL simply doesn’t exist. Google’s Search Central documentation confirms that 410 triggers faster deindexing. If you want a removed page out of search results quickly, 410 is the right choice.

What causes a 502 Bad Gateway error?

A 502 means a server acting as a reverse proxy or load balancer received an invalid response from the upstream server. The most common causes are a crashed application process, a failed SSL handshake between the proxy and upstream, or the upstream returning malformed HTTP. Check the upstream server’s health, not the proxy’s configuration.

When should I return 422 instead of 400?

Return 400 when the request itself is malformed, such as invalid JSON syntax, missing required headers, or unparseable query parameters. Return 422 when the request is syntactically correct but semantically invalid, meaning the data fails business rules like duplicate emails, invalid date ranges, or negative quantities. This distinction helps API consumers distinguish between “fix your request format” and “fix your data.”

How do redirect chains affect SEO?

Each redirect hop adds latency (typically 100-300ms per hop) and can reduce the link equity passed to the final URL. Screaming Frog data shows that chains beyond three hops lose measurable ranking signals. Google recommends keeping redirect chains as short as possible. Audit your redirects regularly and flatten chains to single hops.

test regex patterns for log parsing

Wrapping Up

HTTP status codes are a shared vocabulary between clients and servers. Using the wrong code isn’t just sloppy, it breaks caching, confuses search engines, misleads API consumers, and makes debugging harder. The right code in the right situation means fewer support tickets, better SEO, and APIs that other developers actually enjoy working with.

Use the HTTP Status Codes reference tool to quickly look up any code. And next time you’re tempted to return 200 with an error message in the body, reconsider.

explore all developer tools