Understanding HTTP Status Codes

Every time you click a link, submit a form, or load an image, your browser asks a server for something. The server always answers with a number. That number—the status code—is the server's one-word response before it says anything else.

200 means "here you go." 404 means "never heard of it." 500 means "I broke."

These three-digit numbers are the vocabulary of every conversation on the web.

The Server's Vocabulary

HTTP responses start with a status line:

HTTP/1.1 200 OK

The 200 is what matters. "OK" is just for humans reading logs. Every HTTP client—browsers, apps, scripts—makes decisions based on that number alone.

The first digit tells you the category:

• 1xx: "Hold on, I'm working on it"
• 2xx: "Here's what you asked for"
• 3xx: "It's not here, but I know where it is"
• 4xx: "You asked wrong"
• 5xx: "I broke"

This means you can understand any status code you've never seen. If someone tells you they got a 418, you know it's a client error—the request was the problem, not the server.

The Codes That Matter

Success (2xx)

200 OK — The request worked. Here's your data.

201 Created — The request worked, and I made something new. When you POST a new user and get 201, the server is saying "done, they exist now."

204 No Content — The request worked, but there's nothing to send back. Common after DELETE requests—the thing is gone, there's nothing more to say.

Redirects (3xx)

301 Moved Permanently — "This address changed forever. Update your records." Browsers and search engines remember this.

302 Found — "It's temporarily somewhere else." The original address is still valid; this is just a detour.

304 Not Modified — "You already have the current version." This saves bandwidth. Your browser asked "has this changed?" and the server said "no, use your cached copy."

Client Errors (4xx)

These are the "you messed up" codes.

400 Bad Request — "I can't understand what you're asking." Malformed JSON, missing parameters, syntax errors.

401 Unauthorized — "Who are you?" You haven't authenticated. Show credentials.

403 Forbidden — "I know who you are, and you can't do that." You authenticated, but you don't have permission.

The 401/403 distinction trips people up. Think of a bouncer: 401 is "show me your ID." 403 is "I see your ID, but you're not on the list."

404 Not Found — "I looked. It's not here." This isn't an error in the sense of something breaking—it's a perfectly valid response meaning the resource doesn't exist.

429 Too Many Requests — "Slow down." You've hit a rate limit. Back off and try again later.

Server Errors (5xx)

These are the "I broke" codes. The request was fine; the server couldn't handle it.

500 Internal Server Error — "Something went wrong and I don't know what." The catch-all for unexpected failures. Check the server logs.

502 Bad Gateway — "I'm a proxy, and the server behind me gave me garbage." Common with load balancers when backend servers fail.

503 Service Unavailable — "I'm overwhelmed or down for maintenance." Often includes a Retry-After header suggesting when to try again.

504 Gateway Timeout — "I'm a proxy, and the server behind me didn't respond in time."

Why This Matters

Status codes let machines make decisions without understanding language. Your browser doesn't parse error messages—it sees 301 and follows the redirect, sees 401 and prompts for a password, sees 304 and loads from cache.

This matters for:

Debugging — When something doesn't work, the status code tells you where to look. 4xx means the request is wrong. 5xx means the server is broken. 3xx means you're being sent somewhere else. This narrows down hours of investigation to seconds.

Building APIs — Returning the right status code makes your API predictable. Clients can handle 404 differently from 500 without parsing your error messages.

Caching — Browsers cache based on status codes. 301 redirects can be cached forever. 200 responses are cached according to headers. 304 explicitly says "your cache is good."

SEO — Search engines use status codes to understand your site. 301 transfers ranking to the new URL. 404 removes the page from the index. 302 keeps the original URL indexed.

Common Mistakes

Returning 200 for errors — Some APIs return 200 OK with {"error": "not found"} in the body. This breaks HTTP semantics. Clients can't distinguish success from failure without parsing the body. Use 404.

Using 302 when you mean 301 — If something moved permanently, say so. 302 tells browsers and search engines the old URL is still valid.

Confusing 401 and 403 — 401 means "authenticate." 403 means "even authenticated, you can't." If someone's logged in but lacks permission, that's 403, not 401.

Treating 404 as an error — A 404 isn't broken; it's honest. The server looked, found nothing, and told you. That's correct behavior.

Reading Status Codes

In browser DevTools (F12 → Network tab), every request shows its status code. When debugging:

• 200 but page looks wrong: The request worked; the problem is in rendering or data
• 301/302: You're being redirected—check the Location header
• 401: Authentication is missing or invalid
• 403: You're authenticated but not authorized
• 404: The URL is wrong or the resource doesn't exist
• 500: Server bug—check server logs
• 502/503/504: Infrastructure problem between you and the actual server

The Conversation

HTTP status codes reduce the web's infinite possible outcomes to a manageable vocabulary. Every request gets a response. Every response starts with a number. That number answers the fundamental question: did this work?

The beauty is in the honesty. A server doesn't pretend everything is fine when it isn't. It says 500 when it breaks. It says 404 when something's missing. It says 401 when it doesn't know who you are.

Once you learn to hear what servers are saying, the web becomes less mysterious. The status code is the first word of every answer—and often the only word you need.