HTTP status codes explained: what each one means for your site

Every HTTP response carries a three-digit code. Most people know 404 and 500 and treat the rest as noise, but the codes are the fastest diagnosis available: they tell you which side of the connection failed and often exactly why.

2xx — it worked

200 OK is what you want. 204 No Content is a successful request with nothing to return — normal for APIs. 206 Partial Content appears when a client requests a byte range, typically video.

3xx — go somewhere else

301 Moved Permanently is cached hard by browsers and passes ranking signals to the target. Use it for real moves — and be certain, because browsers remember a 301 for a very long time. 302 Found and 307 are temporary: the original URL keeps its ranking. Using 302 for a permanent move is one of the most common SEO mistakes there is. 304 Not Modified is a good sign: caching is working. Check chains with the redirect checker; each extra hop costs a full round trip.

4xx — the request was wrong

• 400 — malformed request. Usually a client bug, occasionally a proxy mangling headers.
• 401 — authentication required. The credentials are missing or wrong.
• 403 — understood and refused. On an automated check this most often means bot protection, not a broken site. If your own site returns 403 unexpectedly, look at file permissions and firewall rules.
• 404 — not found. A handful is normal on any site; a sudden spike after a deploy means a broken URL structure and needs a redirect map, not a custom error page.
• 410 — gone, deliberately and permanently. Useful for telling search engines a page is never coming back.
• 429 — too many requests. You are being rate-limited. Slow down; the response usually includes a Retry-After header.

5xx — the server broke

• 500 — an unhandled error in your application. The detail is in your server log, never in the response.
• 502 Bad Gateway — a proxy could not get a valid response from the application behind it. Typically PHP-FPM, Node or a container has died.
• 503 Service Unavailable — overloaded or in maintenance. The correct code for planned downtime, ideally with a Retry-After header so crawlers come back rather than dropping the page.
• 504 Gateway Timeout — the application took too long. Look for a slow query or an external API call blocking the request.

What matters for search

Search engines treat these codes as instructions. A 503 during maintenance preserves your rankings; serving a 200 with an "under maintenance" message tells them your content is now that message. A 301 passes almost all ranking signal; a 302 does not. Long redirect chains waste crawl budget and dilute the signal that survives.

The dangerous one: a 200 that should not be

The worst status code is a 200 on a page that failed. "Soft 404s" — an error page returned with a success code — keep dead URLs in the index and hide broken pages from monitoring, because every automated check sees a healthy 200. If your application catches its own errors, make sure it still sets the right status. You can see exactly what your server returns, headers and all, with the header check.