An HTTP status code is a three-digit number a web server returns to say "what it did" with a request from a browser or app. The famous ones are 200 (success), 404 (not found), and 500 (internal server error), but the leading digit splits them into five classes, each with a systematic meaning. This article organizes, accurately, how to read the classes, the easily confused differences between 301 and 302, 401 and 403, and 404 and 410, and the relationship between redirects and SEO.
1xx = informational, 2xx = success, 3xx = redirection, 4xx = client-side error, 5xx = server-side error. Master these five categories and you can read the rough meaning of even a code you have never seen before.
1. What HTTP status codes are — three digits and five classes
When you open a web page, the browser sends the server a request saying "give me this URL," and the server returns a response. The start of that response always carries a three-digit status code and a short reason phrase (for example, 404 Not Found). Humans read the body (HTML), but browsers and search-engine crawlers first look at this number to decide, mechanically, whether the request succeeded, was redirected, or failed.
Codes range from 100 to 599, and the leading digit indicates the class.
| Class | Meaning | Common examples |
|---|---|---|
| 1xx | Informational (processing continues) | 100 Continue, 101 Switching Protocols |
| 2xx | Success | 200 OK, 201 Created, 204 No Content |
| 3xx | Redirection (further action needed) | 301, 302, 304, 307, 308 |
| 4xx | Client error (the requester is at fault) | 400, 401, 403, 404, 429 |
| 5xx | Server error (the server is at fault) | 500, 502, 503, 504 |
These are defined in RFC 9110 (HTTP Semantics, which consolidated earlier specs such as RFC 7231). The codes are extensible — you cannot invent arbitrary numbers of your own — but clients are required to treat an unknown code as its leading-digit class (for example, an unknown 499 is handled as a 4xx client error).
2. 1xx and 2xx — informational responses and success
1xx (informational) is an interim notice meaning "the request was received and processing continues"; it is not the final result. You rarely see it in everyday browsing, but 101 Switching Protocols is an important code used when upgrading from HTTP to WebSocket.
2xx (success) means the request was correctly received and processed.
| Code | Name | Meaning |
|---|---|---|
| 200 | OK | Success. For a GET the body carries the resource; the most common success response |
| 201 | Created | A new resource was created. Used for successful registration via POST |
| 204 | No Content | Succeeded but there is no body to return. Good for delete or settings-update responses |
| 206 | Partial Content | Returned only a part in response to a Range request. Used for video seeking and resuming downloads |
When designing an API, choosing codes that match the meaning — "201 when something was created, 204 for an update that returns no body" — lets callers interpret the outcome correctly.
3. 3xx — redirection (301/302/304/307/308)
3xx (redirection) is the class meaning "the thing you want is elsewhere, or you do not need to fetch it again." In particular, 301 and 302 frequently cause trouble with URL moves and SEO, so it is worth pinning down the difference in meaning precisely.
| Code | Name | Meaning / when to use |
|---|---|---|
| 301 | Moved Permanently | Permanent move. Search engines treat the new URL as canonical. Use for site moves and URL canonicalization |
| 302 | Found | Temporary redirect. Keeps the original URL. Use for campaigns or temporary swaps |
| 303 | See Other | Sends the client to fetch another URL with GET. The classic post-POST switch to a display page (the PRG pattern) |
| 304 | Not Modified | The cache is up to date. Returns "unchanged" without a body to save bandwidth |
| 307 | Temporary Redirect | The strict version of 302. Temporarily redirects without changing the method or body |
| 308 | Permanent Redirect | The strict version of 301. Permanently redirects without changing the method or body |
ETag or modification time in a conditional request (If-None-Match / If-Modified-Since), and if nothing changed the server returns only 304 Not Modified. The browser reuses its local cache, so the display stays correct while bandwidth drops significantly.
4. 4xx — client errors (400/401/403/404/429)
4xx means "there is a problem on the request side." A mistyped URL, insufficient permissions, malformed submitted data — the cause lies with the requester.
| Code | Name | Meaning |
|---|---|---|
| 400 | Bad Request | The request is malformed. Broken JSON, missing required fields, etc. |
| 401 | Unauthorized | Authentication is required (not logged in / no credentials). Despite the name, it means "not authenticated" |
| 403 | Forbidden | Authenticated but lacking permission. Logging in does not help |
| 404 | Not Found | No resource at that URL. Does not say whether the cause is temporary or permanent |
| 405 | Method Not Allowed | The URL exists, but that method (e.g., POST) is not allowed |
| 409 | Conflict | Conflicts with the current state. Edit conflicts, duplicate registration, etc. |
| 410 | Gone | Permanently removed. Unlike 404, it states "it will not come back" |
| 422 | Unprocessable Content | The format is valid but the content is not. Used for validation errors |
| 429 | Too Many Requests | Too many requests. Rate limiting. Uses Retry-After to say when to retry |
401 Unauthorized means "we do not know who you are — please log in," and the server is expected to indicate the scheme with a WWW-Authenticate header. 403 Forbidden means "we know who you are, but that operation is not permitted." Remember it as: if logging in fixes it, it is 401; if logging in does not, it is 403.
5. 5xx — server errors (500/502/503/504)
5xx means "the request was valid, but the server failed to process it." Unlike 4xx, the cause is a server bug, overload, or an upstream service failure, and it usually cannot be fixed by anything the user does.
| Code | Name | Meaning |
|---|---|---|
| 500 | Internal Server Error | An unexpected internal error. The generic failure when the cause cannot be pinned down |
| 501 | Not Implemented | The server does not support that functionality (method) |
| 502 | Bad Gateway | A gateway/proxy received an invalid response from the upstream server |
| 503 | Service Unavailable | Temporarily unavailable (overload or maintenance). Can include Retry-After |
| 504 | Gateway Timeout | A gateway timed out waiting for the upstream server to respond |
502 and 504 often appear in setups with a load balancer, CDN, or reverse proxy in front. They help you isolate "the front proxy is working, but the app server behind it returned an invalid response (502) / did not respond in time (504)." During planned maintenance, correctly returning 503 with a Retry-After tells search engines it is a "temporary outage" and helps avoid mistaken removal from the index.
6. Choosing in practice — 301 vs 302, 404 vs 410
Finally, here are the representative cases where the decision is easy to get wrong in operations. Because a status code is also a message to crawlers, choosing correctly ties directly to SEO and cache efficiency.
- Changing a URL permanently:
301(or308if you must preserve the method). Ranking carries over to the new URL. - Temporarily showing a different page:
302/307. The original URL stays in the index. - Retiring a page for good with no replacement:
410. It drops from the index sooner than404. - Exists but cannot be served right now: for maintenance,
503+Retry-After. Do not confuse it with permanent-removal410or a plain404. - Throttling excessive access:
429+Retry-After. Tell the client the interval before retrying.
Open your browser's developer tools (the Network tab) and you can see the actual status code of each request. Checking whether a code differs from what you intended (for example, a redirect that should be 301 returning 302, or a deleted page returning 200) helps you catch SEO and caching slip-ups early.
Free Tool Look it up with the HTTP Status Codes tool Search by code or name to quickly confirm the meaning and class of each status code. It runs entirely in your browser, no sign-up required.Frequently Asked Questions (FAQ)
What is the difference between 301 and 302?
301 Moved Permanently means the resource has moved for good, so browsers and search engines treat the new URL as canonical and update bookmarks and the index. 302 Found means you are temporarily returning something from another location, keeping the original URL in place. For SEO, always use 301 for permanent URL changes (site moves, URL canonicalization) and 302 for temporary swaps such as campaigns or maintenance. In principle neither 301 nor 302 changes the method, but historically many implementations turned POST into GET, so when you must preserve the method use 308 (permanent) or 307 (temporary).
What is the difference between 404 and 410?
404 Not Found means the resource cannot currently be found at that URL, without saying whether the cause is temporary or permanent. 410 Gone explicitly states that the resource has been permanently removed and will not come back. When search engines receive a 410 they tend to drop the page from the index sooner than with a 404. If you retire a page for good and have no replacement, returning 410 reduces wasted crawl budget and lingering stale URLs.
What is the difference between 401 and 403?
401 Unauthorized means authentication is required (the server does not know who you are, or you are not logged in), and the server is expected to indicate the authentication scheme with a WWW-Authenticate header. 403 Forbidden means you are authenticated but the operation is not permitted (the server knows who you are but you lack permission). A handy rule: if logging in fixes it, it is 401; if logging in does not fix it, it is 403.