HTTP Status Codes Cheat Sheet: 200, 301, 404, 500 and More

The five classes

The status codes are defined in RFC 9110, HTTP Semantics, the IETF standard published in June 2022. A status code is a three-digit number from 100 to 599. Only the first digit has a fixed meaning; it sets the class:

1xx Informational: the request was received and processing continues. An interim answer, always followed by a final one.
2xx Successful: the request was received, understood and accepted.
3xx Redirection: the client has to do something more, usually go to another URL.
4xx Client Error: the request has bad syntax or cannot be fulfilled.
5xx Server Error: the server failed to fulfill an apparently valid request.

The class is the part every client has to understand. A client that gets a code it does not know must treat it like the x00 code of the same class, so an unknown 471 counts as a 400. The words after the number, such as "Not Found", are only recommendations. A server may replace or leave them out, so match on the number, never on the text.

To see the code a URL actually returns, enter it in the HTTP header checker. It follows every redirect and shows the status code of each hop.

Cheat sheet: the codes you will meet

The meanings below paraphrase RFC 9110 unless another RFC is named. The 1xx codes are left out of the tables because they are interim answers that clients handle on their own: 100 Continue tells a client to go on sending a request body, and 101 Switching Protocols confirms a change of protocol on the connection.

2xx success codes

Code	What it means	What to do
200 OK	The request succeeded. For a GET, the content is the page or file you asked for.	Nothing, as long as the page really has content. A 200 page that shows an error message or nothing at all can be reported as a soft 404 in Search Console.
201 Created	The request created a new resource. The Location header, or the request URL itself, identifies it.	Typical answer of an API to a POST. Read the Location header to find what was created.
202 Accepted	Accepted for processing, but not finished. It may still fail later.	Check the status the response points to, later. Nothing has happened yet.
204 No Content	Success, and there is nothing to send back.	Normal for save actions and APIs. A page URL should not answer 204: Google says it then cannot receive any content to process.
206 Partial Content	Success for a range request: only the requested parts of a file are sent.	Normal for video players and resumed downloads.

3xx redirection codes

Code	What it means	What to do
301 Moved Permanently	The resource has a new permanent URL, sent in the Location header. A browser may turn a POST into a GET when it follows.	Use it when a page has moved for good, then update your own links to the new URL.
302 Found	The resource is temporarily at another URL. Keep using the old one. POST may become GET.	Short detours only: a sale page, a login step, maintenance.
303 See Other	Go to a different URL, with GET, for the result of your request.	The clean way to send a browser from a submitted form to a result page.
304 Not Modified	A conditional request found nothing new: the copy the client already has is still valid.	Nothing. It saves bandwidth. You see it in logs when a browser or crawler checks whether a copy it already has is still current.
307 Temporary Redirect	Like 302, but the client must not change the request method.	A temporary redirect for forms and APIs, where a POST has to stay a POST.
308 Permanent Redirect	Like 301, but the client must not change the request method.	A permanent redirect that keeps POST as POST.

4xx client error codes

Code	What it means	What to do
400 Bad Request	The server will not process the request because of what it sees as a client error, such as malformed syntax.	Check the URL, the request body and the headers you send.
401 Unauthorized	Valid credentials are missing. The server must send a WWW-Authenticate header with a challenge.	Log in or send a valid token. If you sent credentials, they were refused.
403 Forbidden	The server understood the request and refuses it. Sending the same credentials again will not help.	As the site owner, check the access rules for that path. As a visitor, you are not allowed in.
404 Not Found	No current representation found, or the server will not say whether one exists. It does not tell whether this is temporary or permanent.	Fix the link that led here, or redirect if the page moved. If it is simply gone, a 404 is correct.
405 Method Not Allowed	The method, such as POST or DELETE, is known but not supported for this URL. The server must list allowed methods in an Allow header.	Use one of the methods in the Allow header.
408 Request Timeout	The server did not receive the complete request in the time it was willing to wait.	Send the request again.
409 Conflict	The request conflicts with the current state of the resource, often an edit that clashes with someone else's.	Reload, resolve the difference and send it again.
410 Gone	The resource is no longer available and this is likely permanent.	Use it for content you removed on purpose, so others can drop their links.
413 Content Too Large	The request body is bigger than the server is willing or able to process.	Upload something smaller, or raise the size limit if it is your server.
414 URI Too Long	The URL is longer than the server will interpret.	Look for a redirect loop that keeps growing the URL, or a form that sends large data with GET instead of POST.
422 Unprocessable Content	The request is well formed, but its content cannot be processed as instructed.	Fix the data the response complains about and send it again.
429 Too Many Requests	Rate limiting: too many requests in a given amount of time (RFC 6585). The response may include Retry-After.	Wait as long as Retry-After says, then send fewer requests.
431 Request Header Fields Too Large	The request headers, all together or one of them, are too large (RFC 6585).	Send smaller headers, for example by clearing cookies for the site that have grown large.

5xx server error codes

Code	What it means	What to do
500 Internal Server Error	The server hit an unexpected condition that stopped it from fulfilling the request.	Check the server's error log. The real cause is there, not in the status code.
501 Not Implemented	The server does not support the functionality the request needs, typically an unknown method.	Use a supported method, or a server that implements it.
502 Bad Gateway	A gateway or proxy got an invalid response from the server behind it.	The proxy or CDN works; look at the origin server it forwards to.
503 Service Unavailable	The server cannot handle the request right now because of temporary overload or scheduled maintenance. It may send Retry-After.	Use it, with Retry-After, while a site is down for maintenance.
504 Gateway Timeout	A gateway or proxy did not get a timely response from the server behind it.	Find the slow step on the origin: a long database query, a stuck process, a timeout set too short.

301 vs 302 vs 307 vs 308

Four codes send a client to another URL in the Location header. They differ on two questions: is the move permanent, and may the client change a POST into a GET when it follows?

Code	Permanent?	POST may become GET?	Google treats it as
301	Yes	Yes, for historical reasons	Strong signal for the new URL
308	Yes	No	Equivalent to 301
302	No	Yes, for historical reasons	Weak signal for the new URL
307	No	No	Equivalent to 302

The history explains the odd pairs. RFC 9110 notes that HTTP/1.0 meant 301 and 302 to keep the method, but browsers split on it and eventually changed a redirected POST into a GET. 307 and 308 were added later to say unambiguously that the method stays the same. 303 See Other is the deliberate version of the change: after a form POST, it sends the browser to a result page with GET.

For search, the line that matters is permanent versus temporary. Google's guide Redirects and Google Search says a permanent redirect makes Google show the new URL in search results and a temporary one keeps the old URL there. Its crawler documentation adds that Google treats 308 like 301 and 307 like 302, but asks you to use the code that fits the meaning anyway, because other clients may rely on the difference. Google's crawlers follow up to 10 redirect hops by default.

Two practical points come straight from the standards:

A 301 can stick. RFC 9110 lists 301 and 308 as heuristically cacheable, and RFC 9111 lets a cache keep such a response for a time it estimates itself when the server sends no explicit expiry. A 302 or 307 is not on that list. If a permanent redirect might still change, send an explicit Cache-Control header with it, or test with a temporary one first.
Keep chains short. A client that follows a redirect sends the request again to the new URL, so every hop is another round trip. RFC 9110 says clients should detect redirect loops and notes that an earlier version of the standard recommended at most five redirects, a limit some clients may still enforce. The redirect generator writes redirect rules for Apache, Nginx and other servers and flags chains and loops in your list, and the website speed test measures the time to first byte and the rest of the page load.

404 vs 410, and the soft 404

RFC 9110 separates the two by what the server knows. A 404 says nothing about whether the absence is temporary or permanent. A 410 says the resource is intentionally gone and the owner would like links to it removed, and the standard prefers it over 404 when the server knows the removal is permanent. It also says it is not necessary to mark every removed page as gone.

Google does not make much of the difference. The Search Console Help article on 404 errors says Google currently treats 410 the same as 404, and Google's crawler documentation says all 4xx codes except 429 are handled alike: the URL is removed from the index if it was indexed, and crawling of it slows down over time. The same help article says 404s do not harm a site's indexing or ranking. For a page you deleted with no replacement, either code is the right answer.

What Google does warn about is the soft 404: a missing page that answers with a code other than 404 or 410, or that redirects to another page such as the home page. Google calls these confusing to users and search engines, and Search Console reports a 200 page that looks like an error or is empty as a soft 404. So:

Page moved: 301 to the new URL.
Page gone, with a close replacement: 301 to that replacement.
Page gone, no replacement: 404 or 410, with a helpful error page. Not a redirect to the home page.
Wrong link on your own site: fix the link. The broken link checker lists every link on a page that returns 404, 410 or a server error.

One more 404 detail from RFC 9110: a server that does not want to reveal that a forbidden resource exists may answer 404 instead of 403. A 404 on a URL you know exists can be an access rule in disguise.

429 and 503: telling clients to slow down

Both codes ask a client to come back later, and both can carry a Retry-After header with either a date or a number of seconds: Retry-After: 120 means wait two minutes. RFC 6585 defines 429 for rate limiting, too many requests in a given time, and says caches must not store it. RFC 9110 defines 503 for temporary overload or scheduled maintenance.

Google's crawlers treat a 429 as a sign that the server is overloaded, the same as a server error. Both 429 and 5xx responses make them slow down temporarily, and already indexed URLs stay in the index for a while but are eventually dropped if the errors persist. For a planned maintenance window, a 503 with Retry-After is the honest answer. A maintenance page served with a 200 is passed on for indexing like any other page, and Search Console may report it as a soft 404.

Google also says not to use 401 or 403 to limit crawling: apart from 429, 4xx codes have no effect on its crawl rate.

500, 502 and 504: whose fault is it?

A 500 comes from the server that handled the request: something unexpected went wrong in its own code or configuration, and the error log has the details. 502 and 504 come from a gateway or proxy in front of it, such as a CDN or a reverse proxy. With a 502, the server behind it sent an invalid response; with a 504, it did not answer in time. Either way the proxy is only the messenger, so start with the origin server it forwards to.

RFC 9110 says a 4xx or 5xx response should explain the error and whether it is temporary or permanent, except for a HEAD request. A custom error page that says what happened and links to your home page or search meets that and gives visitors a way on.

How to check a status code

One URL, with its redirects: the HTTP header checker lists each hop with its code, so you see whether http goes to https in one 301 or in three.
All links on a page: the broken link checker requests every link and image on a page and sorts them into broken, redirected and fine.
In your browser: open the developer tools, switch to the Network tab and reload. The Status column shows the code of every request the page makes.
For Google's view: Search Console reports the URLs where Google's crawlers got a 4xx or 5xx code, a failed redirect or a soft 404.

Frequently asked questions

What is the difference between 301 and 302?

RFC 9110 defines 301 as a new permanent URL and 302 as a temporary one, where the client ought to keep using the original URL. Google follows both, but its crawler documentation calls a 301 a strong signal that the redirect target should be processed and a 302 a weak one. Use 301 when a page has moved for good.

Should I use 404 or 410 for a deleted page?

Either is correct. RFC 9110 prefers 410 when the server knows the removal is permanent and says it is not necessary to mark every removed page as gone. Google's Search Console Help says Google currently treats 410 the same as 404. Pick 410 if your system makes that easy, 404 otherwise, and do not redirect deleted pages to the home page.

Do 404 errors hurt my site in Google?

Google's Search Console Help says 404s do not harm a site's indexing or ranking, and that many are not worth fixing. A 404 for a URL you submitted in a sitemap is worth fixing, and so is a common misspelling of a real URL, which you can redirect.

Is a 503 bad for SEO?

For a short outage it is the right signal. Google's crawler documentation says 5xx and 429 responses make its crawlers slow down temporarily, and already indexed URLs stay in the index, but URLs that keep returning server errors are eventually dropped. Return 503 with a Retry-After header during maintenance and fix the cause if it lasts.

What is the 418 status code?

A joke. It comes from an April 1 RFC that poked fun at the ways HTTP gets abused, and RFC 9110 says it has been deployed as a joke often enough that the code is unusable for anything else, so 418 is reserved in the official registry and not assigned.

Sources

Written by Tobias Kurth, designer. Updated October 20, 2026.