HTTP Status Codes
Quick reference for all HTTP response status codes. Search by code number or keyword, see causes and how to fix common errors.
HTTP Status Code Reference — Complete Guide
HTTP status codes are three-digit numbers returned by a web server in response to every request. They tell the client whether the request succeeded, was redirected, or failed — and why. This reference covers all standard codes with practical explanations, real-world causes, and actionable fixes.
HTTP Status Code Categories
1xx Informational — server received the request, continuing to process. Rarely seen except 101 (WebSocket upgrade). 2xx Success — request was accepted. 200 OK is the most common. 201 Created is returned after successful POST. 204 No Content for successful DELETE with no response body.
3xx Redirection — client needs additional action. 301 Moved Permanently passes SEO authority. 302 Found is temporary redirect. 304 Not Modified tells the browser to use cache. 4xx Client Errors — request has a problem. 400 Bad Request = malformed syntax. 401 Unauthorized = missing auth. 403 Forbidden = authenticated but not authorized. 404 Not Found is the most well-known error.
5xx Server Errors — server failed to fulfill a valid request. 500 Internal Server Error is a catch-all. 502 Bad Gateway = upstream returned invalid response (common with nginx). 503 Service Unavailable = overloaded or maintenance. 504 Gateway Timeout = upstream didn't respond in time.
Most Common HTTP Errors and How to Fix Them
404 Not Found — check URL for typos, verify resource exists, check rewrite rules, confirm the route is defined. 500 Internal Server Error — check application logs (not web server logs), look for unhandled exceptions, database failures, or missing env variables. 502 Bad Gateway — verify upstream app is running, check port matches proxy config, review memory limits (common: app OOM-killed).
429 Too Many Requests — you're hitting a rate limit. Implement exponential backoff and respect Retry-After headers. 401 vs 403 — 401 means "who are you?" (authentication needed), 403 means "I know who you are, but access denied" (authorization).
HTTP Status Codes for REST APIs
Best practices: return 201 for resource creation with a Location header, 204 for successful deletions, 400 for validation errors with details in the body, 409 Conflict for duplicates, and 422 Unprocessable Entity for semantically wrong requests. Include machine-readable error codes alongside HTTP status for easier client handling.