The HTTP Status Codes I Actually Check

An HTTP status code tells you the broad outcome of a request. It does not tell you the whole story. A 200 response can contain the wrong page, and a useful error response can carry details in its headers and body.

The first digit gives you the category:

• 1xx: the request is still in progress or the protocol is changing;
• 2xx: the request succeeded;
• 3xx: the client needs another step, often a redirect;
• 4xx: the request cannot be fulfilled as sent; and
• 5xx: the server failed to fulfil a valid-looking request.

The successful responses are not all 200

200 OK is the normal successful response with a representation in the body.

201 Created is a better response after creating a resource. The Location header can point to the new resource.

204 No Content means the request succeeded and there is no response body. It is useful for an update or deletion where the client needs only confirmation.

206 Partial Content returns a requested byte range, which allows downloads and media playback to resume or seek. Look for Content-Range to see which part arrived.

Redirects need the right method behaviour

301 Moved Permanently says the resource has a lasting new URL. 302 Found describes a temporary redirect, but historical client behaviour around request methods can be surprising.

Use 303 See Other when the next request should be a GET, commonly after a form submission. Use 307 Temporary Redirect or 308 Permanent Redirect when the method and body must be preserved.

304 Not Modified is not a normal redirect to another page. It tells a client with a cached copy that the representation has not changed.

Client errors point in different directions

400 Bad Request means the server could not process the request as sent. 401 Unauthorized really means authentication is required or failed, despite the slightly unhelpful name. 403 Forbidden means the server understood the identity or request but refuses access.

404 Not Found means no current representation was found. 405 Method Not Allowed means the URL exists but not for that HTTP method. 409 Conflict is useful for a state conflict, while 422 Unprocessable Content can describe semantically invalid input.

429 Too Many Requests indicates rate limiting. Check Retry-After when the server sends it instead of retrying harder and becoming the reason the limit exists.

Server errors are not interchangeable

500 Internal Server Error is the generic failure. 502 Bad Gateway means a proxy or gateway received a bad response upstream. 503 Service Unavailable is appropriate for temporary overload or maintenance, and may include Retry-After. 504 Gateway Timeout means the upstream service did not answer in time.

Those distinctions help when a request passes through a CDN, reverse proxy, application server, and database. “The website is down” may be true, but it is not yet a diagnosis.

A few less common codes matter

100 Continue lets a server approve receipt of a potentially large request body after seeing its headers. 101 Switching Protocols confirms a negotiated protocol upgrade, such as the handshake used for WebSockets.

103 Early Hints can send preliminary link headers while the final response is being prepared. Support and real-world benefit depend on the client and delivery path.

When debugging, inspect the full exchange: URL, method, status, response headers, body, redirects, and timing. The three-digit code is the sign on the door. The useful clue is often inside.