HTTP Status Codes Explained

The five classes

• 1xx — Informational. Rare to see directly; the request is still being processed. 101 Switching Protocols (used when upgrading to WebSocket) is about the only one you'll encounter in normal operation.
• 2xx — Success. The request was received, understood, and accepted. 200 OK is the default; 201 Created and 204 No Content are common for APIs.
• 3xx — Redirection. Further action is needed to complete the request, typically following a different URL.
• 4xx — Client error. The request itself was malformed, unauthorized, or pointed at something that doesn't exist.
• 5xx — Server error. The server failed to fulfill a request it understood and should have been able to handle.

3xx codes that trip people up

Not all redirects are equivalent, and the difference matters for both SEO and correctness:

• 301 Moved Permanently — search engines transfer ranking signals to the new URL. Use this for a genuinely permanent move.
• 302 Found — historically meant "temporary," but is widely misused as a default; search engines generally don't transfer ranking signals the way they do for 301.
• 307 Temporary Redirect / 308 Permanent Redirect — the HTTP/1.1 replacements for 302/301 that explicitly guarantee the request method (GET, POST) stays the same on the redirected request, which 301/302 technically don't guarantee.

A redirect chain — 301 to another 301 to another 302 — adds latency on every hit and is a common, easy-to-miss performance regression that a simple "is it 200 or not" check won't surface, since the final destination might still return 200 after several hops.

4xx codes worth distinguishing

• 401 Unauthorized — no valid authentication was provided.
• 403 Forbidden — authentication was fine, but the identity isn't permitted to access this resource.
• 404 Not Found — the resource genuinely doesn't exist at this URL.
• 429 Too Many Requests — rate limiting kicked in. Worth watching for on your own API, and worth respecting (via backoff) when calling someone else's.

4xx codes usually mean "the client did something wrong," not "the server is broken" — a spike in 404s often just means something links to a page that moved, not an outage.

5xx codes: the ones that should page someone

5xx means the server acknowledged the request was valid and still failed to handle it — this is the class that represents an actual application or infrastructure problem, not user error:

• 500 Internal Server Error — a generic catch-all for an unhandled exception. Vague by design, but always worth investigating.
• 502 Bad Gateway — a proxy or load balancer got an invalid response from an upstream server, often meaning the actual application server crashed or isn't running.
• 503 Service Unavailable — the server is temporarily unable to handle the request, commonly due to overload or planned maintenance.
• 504 Gateway Timeout — a proxy gave up waiting for an upstream response, usually pointing at a slow database query or a downstream dependency that's stalled.

Any of these, especially sustained over more than a check or two, is the kind of signal that belongs in a real-time alert rather than a dashboard someone checks once a day.