Understanding HTTP status codes
Every answer on the web starts with a three-digit number. It says whether things worked – and if not, whose problem it is.
The first digit already gives the direction: 2xx worked, 3xx points elsewhere, 4xx is about the request, 5xx about the server. Everything else is below. To see what a specific address answers, put it in the check field.
2xx Success
The request worked. Rarely interesting here – except for 204 and 206.
- 200 OK
- The normal case: the page exists and is delivered.
- 204 No Content
- Successful, but empty. Common for APIs; on a web page usually a bug in the application.
- 206 Partial Content
- Only a range was delivered – typical for video streaming or resumed downloads.
3xx Redirection
The real address lives elsewhere. Which code appears here decides what browsers and search engines make of it.
- 301 Moved Permanently
- Moved for good. Search engines transfer the ranking signals to the target and replace the old address in their index. Browsers cache this aggressively – a 301 set by mistake is hard to undo for visitors.
- 302 Found
- Temporarily elsewhere. The original address stays authoritative. Moving permanently with a 302 wastes the signal transfer.
- 303 See Other
- Send the visitor to a result page after a form submission – prevents a reload from submitting the data again.
- 307 Temporary Redirect
- Like 302, but the request method is preserved. A POST stays a POST instead of becoming a GET.
- 308 Permanent Redirect
- Like 301, also preserving the method.
- 304 Not Modified
- Unchanged since the last visit – the browser uses its stored copy. Not an error, but caching doing its job.
4xx Something is wrong with the request
The server is running but refuses this particular request. This is where a closer look pays off most.
- 400 Bad Request
- The request was malformed. Also a common answer from protection systems that would rather not explain why they refuse.
- 401 Unauthorized
- Sign-in required – and not yet provided. Despite the name this is about authentication, not permission.
- 403 Forbidden
- The server knows who is asking and still says no. For automated requests this is often bot protection blocking data-centre addresses.
- 404 Not Found
- Nothing at this address. Whether it never existed or was deleted stays open.
- 410 Gone
- Deliberately and permanently removed. A clearer statement than 404 – search engines drop the address from their index faster.
- 429 Too Many Requests
- Too many requests in too short a time. The response often carries a Retry-After header with the waiting time.
- 451 Unavailable For Legal Reasons
- Blocked for legal reasons, for instance after an official order.
5xx Something is wrong on the server
The request was fine, the server cannot handle it. Trying again can make sense.
- 500 Internal Server Error
- A catch-all for a fault in the application. The cause sits in the server log, not in the response.
- 502 Bad Gateway
- An upstream server received no usable answer – typical when the actual application behind a proxy is not running.
- 503 Service Unavailable
- Temporarily unavailable: maintenance or overload. The correct code for planned downtime, because search engines keep the page indexed.
- 504 Gateway Timeout
- The upstream server waited too long for an answer.
The four mix-ups that cost the most
301 instead of 302 – and the other way round
Moving permanently with a 302 wastes the transfer of ranking signals to the new address. Redirecting temporarily with a 301 creates the opposite problem: browsers cache permanent redirects stubbornly, and the old address disappears from the index. Rule of thumb: use 301 only when the old address will never serve its own content again.
404 instead of 410
Both say „not here“. 410 adds „deliberately, and for good“. For pages removed on purpose that is the more honest and faster answer – search engines clear them from the index sooner.
401 instead of 403
401 means: I do not know who you are – please sign in. 403 means: I do know, and you still may not. A 403 on a public page is therefore almost always a protection system, not a permission problem.
500 instead of 503 during maintenance
Serving 500 during maintenance signals a broken server. 503 signals a pause – and search engines keep the page indexed instead of treating it as defective.
Why a screenshot shows none of this
Status codes live in the response header, not in the visible content. A page can display a pretty error message and still send 200 – to a search engine that looks like a valid page. Conversely, an ordinary-looking page may be the end of several redirects, each saying something different.
LinkSniffer makes exactly that chain visible – enter an address and look. How such chains come about is covered under checking redirects.