HTTP Status Codes That Actually Matter, and When to Use Each
4 min read4 October 2026By Muhammad Abdullah
There are dozens of HTTP status codes, but a working developer meets about a dozen of them, and most confusion comes from a few close pairs. Getting them right matters more than it seems: the wrong redirect can cost a page its search ranking, and the wrong error code makes an API harder to use than it needs to be.
The five families
- 1xx: informational, rarely seen directly.
- 2xx: success. The request worked.
- 3xx: redirection. Look somewhere else.
- 4xx: client error. The request was wrong, and sending it again unchanged will not help.
- 5xx: server error. The request may have been fine; the server failed.
Success: 200, 201 and 204
200 OK is the general success. 201 Created says a new resource was made, and should come with its location. 204 No Content means success with nothing to return, which suits a delete.
Redirects: 301, 302, 307 and 308
301 means moved permanently: search engines transfer the old URL's standing to the new one and eventually show the new URL instead. 302 means found elsewhere for now: search engines keep the old URL, expecting it to come back.
308 and 307 are the strict versions of 301 and 302. With the older codes, browsers may turn a POST into a GET when following the redirect; 307 and 308 keep the method and body as they were. For API endpoints that receive POST requests, use 307 or 308.
401 vs 403
401 Unauthorized really means unauthenticated: we do not know who you are, so log in or send a valid token. 403 Forbidden means we know who you are, and you are not allowed to do this. Logging in again will not fix a 403.
404 vs 410
404 Not Found says nothing is here, without saying whether that is permanent. 410 Gone says it existed and was removed on purpose. Search engines tend to drop a 410 from their index a little faster, so use it for pages you have deliberately deleted with no replacement. If there is a replacement, redirect instead.
One mistake to avoid: a page that says "not found" but returns 200. Search engines call this a soft 404, and it can fill an index with empty pages.
Other client errors worth knowing
- 400 Bad Request: the request is malformed, such as invalid JSON.
- 405 Method Not Allowed: the URL exists but does not accept this method, such as a GET to a POST-only endpoint.
- 409 Conflict: the request clashes with the current state, such as creating a user whose email already exists.
- 422 Unprocessable Content: well-formed but invalid, such as a date in the past where a future date is required.
- 429 Too Many Requests: slow down. A good API includes a Retry-After header saying how long to wait.
Server errors: 500, 502, 503 and 504
- 500 Internal Server Error: the application crashed or hit an unhandled error. Check your application logs.
- 502 Bad Gateway: a proxy or load balancer in front of your app got an invalid response, often because the app is down or crashed mid-request.
- 503 Service Unavailable: the server is overloaded or in maintenance. Use it for planned downtime, with Retry-After, so search engines know to come back.
- 504 Gateway Timeout: the proxy gave up waiting for your app. Look for slow queries or calls to other services.
Common questions
What is the difference between 301 and 302?
301 is permanent and passes the old URL's search standing to the new one. 302 is temporary, so search engines keep the original URL indexed.
Should I return 401 or 403?
401 when the user is not logged in or the token is missing or invalid. 403 when they are logged in but not allowed to perform the action.
What causes a 502 Bad Gateway?
A proxy or load balancer received no valid response from the application behind it, usually because the app crashed, restarted or is not running.