HTTP Status Codes

HTTP status codes are three-digit numbers returned by the server indicating the outcome of a client's request. The first digit defines the class of response. Clients act on the status code regardless of the response body content.

The standard status codes each carry specific semantics: 200 confirms success, 301 signals a permanent redirect, 404 indicates a missing resource, and 500 reports a server failure.

Table of Contents

How status code classes work

The first digit sets the outcome and the remaining two digits narrow the reason. A client meeting an unfamiliar code falls back to the class, so an unrecognized 4xx gets handled as a generic client error and an unrecognized 5xx as a generic server error. Treating the class as the contract keeps clients working when servers return codes outside the standard set, which happens often behind CDNs and reverse proxies.

Class Meaning Client action
1xx Request received, processing continues Wait for the final response
2xx Request succeeded Use the response body
3xx Further action required Follow the Location header
4xx Problem in the request Change the request before retrying
5xx Server failed a valid request Retry later or surface the failure

The split between 4xx and 5xx assigns responsibility. A 4xx response places the fault in the request, so repeating the same request produces the same answer. A 5xx response places the fault in the server, so an identical request often succeeds on a later attempt. Retry logic depends on the distinction: retrying a 4xx wastes requests, and retrying a 5xx with backoff usually clears.

Choosing the right status code

Status code choice follows the outcome the server needs to signal, and a handful of pairings account for most production mistakes. Clients and search engines act on the number rather than the words on the page, so an inaccurate code misleads both.

Missing resources return 404 for an ordinary absence and 410 when the removal is deliberate and permanent. Both drop a URL from search results, and 410 tends to drop faster.

Moved resources return 301 for a permanent move and 302 for a temporary one. Marking a permanent move as temporary keeps the old address as the indexed URL and delays consolidation onto the new one. Method preservation separates the older and newer redirect codes: 301 and 302 allow clients to turn a POST into a GET, while 307 and 308 preserve the original method and body.

Planned maintenance returns 503 with a Retry-After header. Serving 200 with a maintenance message leaves the page indexable and risks the outage text reaching search results.

Rate limiting returns 429. Substituting 403 hides the reason and prevents clients from backing off correctly. Authentication failures return 401 when credentials are missing or invalid, and 403 when valid credentials lack permission for the resource.

Status codes outside the standard set

Infrastructure vendors define codes beyond the registered range, and the values collide across products. Reading an unexpected code starts with identifying the software returning the response.

Unofficial codes carry real consequences in production even without IANA registration, and a response arriving with an unregistered number still needs a decision from the client.

Cloudflare occupies 520 through 530 for edge and origin failures, with 522 for a connection timeout and 524 for an origin taking too long to respond. nginx returns 444 to close a connection without a response, and uses 494 through 499 for oversized headers, TLS certificate problems, and clients disconnecting early. Microsoft products return 440 for session timeouts and 449 for retry signals. Edgio uses the Project codes from 531 upward for upstream and configuration failures, and Akamai Enterprise Application Access occupies much of the 545 to 562 range for authentication and gateway problems.

Collisions are common enough to matter. 530 carries separate meanings at Cloudflare, Pantheon, Shopify, and Edgio, and 562 means a credential error at Akamai and a JWKS request failure on an AWS Application Load Balancer. Identifying the software in front of the origin comes before interpreting the number.

Codes above the valid range

Three-digit numbers above 599 fall outside the 100 to 599 range and stay unregistered, appearing in vendor tooling and in responses from a small number of large platforms.

Akamai applies 600 inside dashboards and log data for transactions with malformed headers. Edgio raises 893 when traffic for a single asset overwhelms the serving capacity of a point of presence. LinkedIn returns 999 to traffic identified as automated or scraping.

1xx: Informational

Informational responses indicate the request was received and processing continues. The server sends a final response after the informational one.

2xx: Success

Success responses indicate the request was received, understood, and accepted.

3xx: Redirection

Redirection responses indicate further action is needed to complete the request. The client follows the Location header to the new address.

4xx: Client error

Client error responses indicate the request contains a problem the server cannot process, such as malformed syntax, missing Authentication, or a non-existent resource.

5xx: Server error

Server error responses indicate the server recognized a valid request but failed to fulfill the request due to an internal problem.

Warning header codes

Warning codes travel in the Warning header rather than on the status line, and caches attach them to describe the state of a stored response. The numbers overlap the 1xx and 2xx status ranges while carrying separate meanings, so reading a warning code as a status code produces the wrong conclusion.

See also

Last updated: August 17, 2026