Status Codes Worth Knowing, and the Ones to Avoid
There are around sixty registered status codes. A working web server uses perhaps fifteen. This page is those fifteen, what each one tells a browser and a crawler, and the mistakes the checker flags around them.
2xx: It Worked
| Code | Meaning | Use it for |
|---|---|---|
| 200 OK | Here is the resource. | Every normal page and file. Not for error pages: a "not found" page served with 200 is a soft 404 that search engines index as a real page. |
| 201 Created | Your POST or PUT made a new resource; Location says where. | APIs. |
| 204 No Content | Done, nothing to show. | DELETE responses, beacon endpoints, form handlers that should not navigate. |
| 206 Partial Content | Here is the byte range you asked for. | Video seeking and resumed downloads. Requires Accept-Ranges: bytes. |
3xx: Look Somewhere Else
The redirects are where most of the confusion lives, because four codes do almost the same thing with two differences: whether the move is permanent, and whether a POST stays a POST.
| Code | Permanent | Method kept | Use it for |
|---|---|---|---|
| 301 Moved Permanently | yes | no (POST becomes GET) | Moved pages, http to https, www to non-www. Browsers cache it hard and search engines pass signals to the new URL. |
| 302 Found | no | no | Temporary detours: maintenance, A/B tests, geo landing pages. Search engines keep the old URL indexed. |
| 303 See Other | no | no, always GET | After a form POST, to send the browser to a results page so a refresh does not resubmit. |
| 307 Temporary Redirect | no | yes | Like 302 but a POST stays a POST. Also what browsers show internally for an HSTS upgrade. |
| 308 Permanent Redirect | yes | yes | Like 301 but a POST stays a POST. Right for API endpoints that moved. |
| 304 Not Modified | n/a | n/a | Answer to a conditional request (If-None-Match, If-Modified-Since): "your cached copy is still good". No body. Not a redirect despite the number. |
Three things go wrong with redirects. Chains: http to https to www to trailing slash is four round trips for one page; point the first hop straight at the last. Temporary codes on permanent moves: a 302 that has been in place for two years is a 301 that search engines have been declining to honour. Redirecting to a redirect, an error or a noindex page: the chain ends somewhere useless. The checker lists every hop with its code and time so all three are visible at once.
4xx: You Asked for Something Wrong
| Code | Meaning | Notes |
|---|---|---|
| 400 Bad Request | The request could not be parsed. | Malformed URLs, oversized headers, broken JSON in an API call. |
| 401 Unauthorized | Log in first. | Must come with WWW-Authenticate. Despite the name it means unauthenticated. |
| 403 Forbidden | You are known and still not allowed. | Also what many hosts send for blocked IPs, hotlink protection and directory listings. Crawlers treat a 403 on robots.txt as "no rules". |
| 404 Not Found | Nothing here. | Search engines drop the URL after a few visits. Serve a real 404 page with a 404 code, never a 200. |
| 405 Method Not Allowed | Right URL, wrong verb. | Comes with an Allow header listing what works. |
| 410 Gone | Was here, deliberately removed. | Search engines drop it faster than a 404. Use it when you mean it. |
| 429 Too Many Requests | Slow down. | Send Retry-After. Rate limiters that answer 403 or 503 instead confuse everyone. |
| 451 Unavailable For Legal Reasons | Blocked by law in this region. | The honest code for geo-blocking on legal grounds. |
5xx: The Server Failed
| Code | Meaning | Where to look |
|---|---|---|
| 500 Internal Server Error | The application crashed. | The application or PHP error log. Search engines retry, then drop the page if it persists. |
| 502 Bad Gateway | The proxy got a bad answer from the upstream. | The app server behind nginx or the CDN is down or returned garbage. |
| 503 Service Unavailable | Temporarily overloaded or in maintenance. | Send Retry-After. The right code for planned downtime: Googlebot comes back later and keeps the page indexed. |
| 504 Gateway Timeout | The upstream did not answer in time. | A slow database query or a hung worker. The proxy timeout is usually 30 to 60 seconds. |
Cloudflare adds its own 520 to 530 range for problems between its edge and your origin: 521 (origin down), 522 (connection timed out), 523 (origin unreachable), 524 (origin took too long), 525 and 526 (TLS handshake or certificate problems at the origin), 530 (origin DNS error). They are all "the CDN could not reach you", and the fix is always at the origin.
Codes That Look Right and Are Not
- 200 for an error page. The soft 404. The checker looks at the title of a 200 response and warns when it reads like a not-found page.
- 302 for a permanent move. Change it to 301 (or 308 for APIs).
- 301 for a temporary detour. Browsers cache 301s aggressively; when the detour ends, visitors are stuck. Use 302 or 307.
- 403 for a page that does not exist. Some hosts do this to hide structure; it also hides the page from search engines the wrong way. Use 404.
- 503 without Retry-After. Clients have no idea whether to retry in a second or an hour.
- 200 with an empty body from an API. Say 204.
The headers guide covers the headers that travel with these codes: Location, Retry-After, Allow and WWW-Authenticate.