Support Library
HTTP Status Codes Explained
An HTTP status code is the three-digit number a web server sends back to say how a request went, such as 200 for success or 404 for a missing page. This guide explains each class and the codes you will meet most often.
The short answer
Every time a browser or tool asks a web server for a page, the server answers with a three-digit status code before anything else. The first digit tells you the kind of answer:
| Class | Meaning | Who needs to act |
|---|---|---|
| 1xx | Informational: keep going | Nobody. Browsers handle these. |
| 2xx | Success | Nobody. The request worked. |
| 3xx | Redirection: look somewhere else, or use a cached copy | Nobody, unless the redirect goes somewhere unexpected. |
| 4xx | Client error: the request was wrong or not allowed | Whoever made the request, or the site owner if a link is broken. |
| 5xx | Server error: the site failed | The site owner or their hosting provider. |
The codes are defined in RFC 9110. Servers may send codes the standard does not list, and clients treat an unknown code like the x00 code of its class.
1xx informational
These are interim answers sent before the real one. You will rarely see them, because browsers and tools wait for the final code.
| Code | Name | What it means |
|---|---|---|
| 100 | Continue | The server has the request headers and is ready for the body. Used before large uploads. |
| 101 | Switching Protocols | The connection is changing to another protocol, most often a WebSocket. |
| 103 | Early Hints | A preview of headers, so the browser can start loading styles and scripts before the page is ready. |
2xx success
| Code | Name | What it means |
|---|---|---|
| 200 | OK | The request worked and the response holds what was asked for. This is what a healthy page returns. |
| 201 | Created | Something new was created, usually after a form or API call. |
| 202 | Accepted | The request was accepted but the work will happen later. |
| 204 | No Content | The request worked and there is nothing to send back. |
| 206 | Partial Content | Only part of a file was sent, as asked. Used for video streaming and resumed downloads. |
A 200 does not always mean the page is right. Some sites return 200 for an error page or an empty template, which search engines call a soft 404. Check what the page actually says as well as its code.
3xx redirection
Most 3xx codes are redirects. A redirect comes with a Location header naming where to go next, and a browser follows it on its own, so one visit can pass through several redirects before it lands on a page. The exception is 304, which is not a redirect: it tells the browser to reuse the copy it already has.
| Code | Name | What it means |
|---|---|---|
| 301 | Moved Permanently | The page has a new permanent address. Browsers and search engines update to it. |
| 302 | Found | A temporary redirect. The old address is still the real one. |
| 303 | See Other | Go and fetch another page with GET, typically after a form is submitted. |
| 304 | Not Modified | Not a redirect. The browser asked whether its cached copy is still current, and it is, so nothing is resent and there is nowhere to go. |
| 307 | Temporary Redirect | Like 302, but the browser must repeat the same method and body at the new address. |
| 308 | Permanent Redirect | Like 301, but the method and body must be kept. |
Use 301 or 308 for a move that will not be undone, such as http to https or an old domain to a new one. Use 302 or 307 for anything temporary. Keep chains short: each hop costs a round trip, and browsers give up after about twenty.
A redirect to a different domain deserves a second look. It is normal when a company moves to a new name, but it is also how hacked sites and parked domains send visitors to spam or phishing pages.
4xx client errors
| Code | Name | What it means |
|---|---|---|
| 400 | Bad Request | The server could not understand the request, often because of a malformed URL, header or cookie. |
| 401 | Unauthorized | You need to sign in. Despite the name, it is about authentication. |
| 403 | Forbidden | The server knows who you are, or does not care, and still refuses. Firewalls and bot protection often answer 403. |
| 404 | Not Found | Nothing exists at this address, or the server will not say whether it does. |
| 405 | Method Not Allowed | The address exists but does not accept this method, such as a POST to a page that only allows GET. |
| 408 | Request Timeout | The client took too long to send its request. |
| 409 | Conflict | The request clashes with the current state, such as editing something that changed in the meantime. |
| 410 | Gone | The page has been removed on purpose and will not come back. Search engines drop it faster than a 404. |
| 413 | Content Too Large | The upload or request body is bigger than the server accepts. |
| 421 | Misdirected Request | The request reached a server that does not serve that hostname, often after a DNS or certificate change. |
| 422 | Unprocessable Content | The request was well formed but its contents failed validation. |
| 429 | Too Many Requests | You have been rate limited. Wait before trying again; a Retry-After header may say how long. |
| 451 | Unavailable For Legal Reasons | The content is blocked because of a legal demand. |
A 403 or 429 for an automated check does not always mean a person would be blocked. Many sites put a firewall or bot challenge in front of their pages that refuses scripts and tools while letting browsers through.
5xx server errors
| Code | Name | What it means |
|---|---|---|
| 500 | Internal Server Error | Something went wrong in the site’s own code or configuration. |
| 501 | Not Implemented | The server does not support what was asked for. |
| 502 | Bad Gateway | A proxy, load balancer or CDN got a bad or no answer from the server behind it. |
| 503 | Service Unavailable | The server is overloaded or down for maintenance. Usually temporary. |
| 504 | Gateway Timeout | A proxy, load balancer or CDN gave up waiting for the server behind it. |
A 502 reports an invalid upstream response; a 504 reports an upstream timeout. The gateway handled this request, but that does not establish that the proxy service is healthy or that the origin alone is at fault. Check origin health alongside gateway upstream DNS, routing, TLS, connection pools and configuration. The load balancers guide shows the layers involved.
Non-standard codes you may see
Some servers and CDNs use their own codes for problems the standard does not cover. The most common ones come from nginx and Cloudflare:
| Code | Name | What it means |
|---|---|---|
| 499 | Client Closed Request (nginx) | The visitor gave up before the server answered. It only appears in server logs. |
| 520 | Unknown Error (Cloudflare) | The origin server sent something Cloudflare could not understand, or closed the connection. |
| 521 | Web Server Is Down (Cloudflare) | The origin refused the connection. The web server is stopped or a firewall blocks Cloudflare. |
| 522 | Connection Timed Out (Cloudflare) | Cloudflare could not open a connection to the origin in time. |
| 523 | Origin Is Unreachable (Cloudflare) | Cloudflare could not find a route to the origin, often because of a wrong DNS record. |
| 524 | A Timeout Occurred (Cloudflare) | The origin accepted the connection but took too long to send a response. |
| 525 | SSL Handshake Failed (Cloudflare) | Cloudflare and the origin could not agree on a TLS connection. |
| 526 | Invalid SSL Certificate (Cloudflare) | Cloudflare could not validate the origin certificate in its verification context, for example Full (strict). Check expiry, hostname and trust chain; a Cloudflare Origin CA certificate is trusted by Cloudflare and is not equivalent to an arbitrary self-signed certificate. |
Cloudflare 52x codes describe failures Cloudflare observed while communicating with the origin. They do not prove that the whole Cloudflare service is healthy or isolate every cause to the origin. Check the origin, Cloudflare configuration and the path between them; a 523 often warrants checking the configured origin address and routing.
When there is no status code
A status code only exists if the server answered. These failures happen before that point, so a tool reports an error instead of a code:
- The name does not resolve. DNS has no address for the host, or the lookup failed. See DNS response codes.
- The connection is refused. The address answered, but nothing is listening on the port, usually 443 or 80. The common ports guide lists which ports a website needs.
- The connection times out. A firewall dropped the traffic, the server is down, or the address is wrong.
- The TLS handshake fails. The certificate has expired, is for another name, or the server does not support HTTPS at all.
How our tools show status codes
Website Recon opens the homepage over https, falling back to http, and follows up to five redirects one hop at a time. The Homepage card shows the status code of the page it landed on, and the Redirects list shows the code of every hop along the way, so you can see whether a move is permanent or temporary and where it leads.
The HTTP Status Code Verification tool in Zone Analyzer checks the A, AAAA and CNAME records you select in a zone file. It requests each host over HTTPS, follows any redirects, and shows the final status code. Codes from 200 to 399 count as OK; anything else, or no answer at all, counts as an error you can filter for and retry.
Both tools are automated checks, so a site that blocks bots may answer them with a 403 or 429 even though it works in a browser.
FAQ
What is the difference between a 301 and a 302 redirect?
A 301 says the page has moved for good, so browsers and search engines switch to the new address. A 302 says the move is temporary and the old address is still the real one.
Is a 404 error bad for my site?
A 404 for a page that never existed is normal. A 404 for a page people link to is worth fixing with a 301 redirect to its new home, or a 410 if it is gone for good.
What is the difference between a 502 and a 504?
Both come from a proxy, load balancer or CDN in front of the site. A 502 means the server behind it sent a bad answer or closed the connection. A 504 means it did not answer in time.
Why does a site load in my browser but show 403 in a checker?
Many sites use bot protection that blocks automated requests. The checker is seeing the firewall’s answer, not the page a person would see.