HTTP status codes are three-digit numbers that a server sends with every response to say how the request went. The first digit is the class: 1xx informational, 2xx success, 3xx redirect, 4xx client error, 5xx server error. This cheat sheet lists the codes you will really meet, what each one means in practice, and which ones matter for SEO and for monitoring.
The five classes
| Class | Meaning | Who has to act |
|---|---|---|
| 1xx Informational | Request received, still in progress (100 Continue, 101 Switching Protocols) | Nobody. You rarely see these directly |
| 2xx Success | The request worked | Nobody |
| 3xx Redirection | The resource is at another URL, or your cached copy is still good | The client follows it. Check where it leads |
| 4xx Client error | The request was wrong: bad URL, not logged in, not allowed | Usually the requester. The site owner if its own links are broken |
| 5xx Server error | The server failed on a valid request | The site owner |
The cheat sheet
| Code | Name | What it means in practice |
|---|---|---|
| 200 | OK | Success, and the response contains what was asked for. |
| 201 | Created | A new resource was created, usually by a POST. Common in APIs. |
| 204 | No Content | Success with nothing to return. Typical after a DELETE or a save. |
| 301 | Moved Permanently | The URL has moved for good. Use the new address from now on. |
| 302 | Found | Temporary redirect. Keep using the original URL. |
| 304 | Not Modified | Your cached copy is still valid, so no body is sent. Normal and healthy. |
| 307 | Temporary Redirect | Like 302, but the method and body must not change: a POST stays a POST. |
| 308 | Permanent Redirect | Like 301, but the method and body must not change. |
| 400 | Bad Request | The server could not understand the request: broken syntax, invalid JSON, oversized headers or cookies. |
| 401 | Unauthorized | Credentials are missing or invalid. Log in or send a valid token. |
| 403 | Forbidden | The server refuses the request. Permissions, IP blocks and firewall rules land here. |
| 404 | Not Found | Nothing exists at this URL. It does not say whether that is temporary or permanent. |
| 405 | Method Not Allowed | The URL exists but does not accept this method, for example a POST to a read-only endpoint. |
| 408 | Request Timeout | The server gave up waiting for the client to finish sending its request. |
| 410 | Gone | Removed on purpose and not coming back. |
| 422 | Unprocessable Content | The request was well formed but the data failed validation. Common in APIs and form handling. |
| 429 | Too Many Requests | A rate limit was hit. Often sent with a Retry-After header. |
| 500 | Internal Server Error | The application or server hit an unexpected error. See our 500 error guide. |
| 501 | Not Implemented | The server does not support the method or feature the request needs. Rare. |
| 502 | Bad Gateway | A proxy got an invalid answer from the server behind it. See the 502 guide. |
| 503 | Service Unavailable | Temporarily unable to respond: overload or maintenance. See the 503 guide. |
| 504 | Gateway Timeout | A proxy gave up waiting for the server behind it. See the 504 guide. |
You will also meet codes that are not in the standard. The best known are Cloudflare's 520 to 526, covered in our guide to Cloudflare 52x errors.
The four redirect codes compared
| Method may change to GET | Method is kept | |
|---|---|---|
| Permanent | 301 | 308 |
| Temporary | 302 | 307 |
For ordinary page moves, 301 and 302 are what you need. 307 and 308 matter when a redirect must not turn a form submission or an API POST into a GET.
Status codes that matter for SEO
301 vs 302
Google reads a permanent redirect (301 or 308) as a strong signal that the new URL should replace the old one in search results. A temporary redirect (302 or 307) is a weak signal, and the old URL usually stays indexed. Many frameworks and plugins default to 302, so a page that has moved for good can keep showing its old address in search results. If the move is meant to last, send a 301.
404 vs 410
Both tell search engines the page does not exist, and both get the URL removed from the index. Google treats them almost the same way, though a 410 can be dropped a little sooner. Use 410 when you removed something deliberately, 404 for everything else. A 404 on a URL that should not exist is correct and harmless. It is only a problem when the page is supposed to be there or when your own links point at it.
Soft 404s
A soft 404 is a page that says "not found" (or is empty) but answers 200. Search engines get a success code with no content, so they may index the empty page or flag it in Search Console. Redirecting every missing URL to the homepage has the same effect. Return a real 404 or 410, or redirect to a page that truly replaces the old one.
5xx errors and crawling
Server errors and 429 make Googlebot slow down. A short outage does no harm, but URLs that keep returning 5xx for days are eventually dropped from the index. For planned maintenance, send a 503 with a Retry-After header, never a 200 with a maintenance message. Watch robots.txt in particular: while it returns a 5xx, Google temporarily treats the whole site as blocked from crawling.
A page that returns 200 and still does not show up in Google has a different problem. See why a page is not indexed by Google.
Status codes that matter for monitoring
- 2xx: healthy. Decide exactly which codes count. For a health endpoint that is normally 200 and nothing else.
- 3xx: usually fine, but check the destination. A page that suddenly redirects to a login screen or a parked domain is a silent failure.
- 401 and 403 on a public page: a firewall rule, a geo-block or a broken auth change is shutting visitors out.
- 404 on a key URL: a deploy removed a route or a file.
- 429: a rate limit is too tight for real traffic, or it is blocking your own monitoring.
- 5xx: an outage. The exact code tells you which layer to look at first.
The worst failures have no status code at all. A DNS failure, a refused connection, a timeout or an expired certificate ends the request before any HTTP response exists, so a monitor has to treat those as down too.
In Upmonora you choose which status codes count as healthy for each monitor, as single codes or as ranges such as 200-299. A check follows up to 5 redirects and judges the final response. Any other code, and any failure without a code, counts as a failed check. Website monitoring records the status code of every check, so you can see when a page began returning the wrong one.
How to check a status code from the command line
# Status line and headers (sends a HEAD request)
curl -I https://example.com/page
# Just the code, using a normal GET
curl -s -o /dev/null -w "%{http_code}\n" https://example.com/page
# Follow redirects and show every hop
curl -sIL http://example.com/old-page
# Final code, final URL and number of redirects
curl -s -o /dev/null -L -w "%{http_code} %{url_effective} (%{num_redirects} redirects)\n" http://example.com/old-page
A few servers answer HEAD differently from GET, so trust the GET version when the two disagree. To check a list of URLs, one per line in urls.txt:
while read -r url; do
printf '%s %s\n' "$(curl -s -o /dev/null -w '%{http_code}' "$url")" "$url"
done < urls.txt
On Windows 10 and later, curl.exe -I https://example.com/page works in PowerShell. In a browser, open DevTools, switch to the Network tab and reload: the Status column shows the code of every request.
Check a status code with free tools
- The HTTP Status Checker shows the status code a URL returns, the redirects on the way, the response time, the protocol and every response header. It also flags soft 404s.
- The Redirect Checker traces a redirect chain hop by hop and points out loops and temporary redirects.
- The Link Checker tests the links on a page and reports the broken ones.
- The free website checker gives the status code, response time and SSL status of any public URL in one go.
All of them request the URL from our servers, so you see what the outside world sees, not what your browser has cached. A one-off check only describes the moment you ran it. To hear about it when a page starts returning the wrong code, add it to uptime monitoring: the free plan covers 5 monitors.
Frequently asked questions
What are the five classes of HTTP status codes?
1xx is informational, 2xx means success, 3xx is a redirect, 4xx is a client error (the request was wrong) and 5xx is a server error (the server failed on a valid request). The first digit of the code gives the class.
What is the difference between a 301 and a 302 redirect?
A 301 is permanent: browsers and search engines should use the new URL from now on. A 302 is temporary: the original URL stays the one to use and to index. Use a 301 for any move that is meant to last.
What is the difference between 401 and 403?
A 401 means the request has no valid credentials, so logging in or sending a valid token can fix it. A 403 means the server understood the request and refuses it, and authenticating again will not help.
Which HTTP status codes are bad for SEO?
Persistent 5xx errors slow down crawling and can get pages dropped from the index. 404 and 410 remove a URL from search results, which is only a problem when the page should exist. Soft 404s and temporary redirects used for permanent moves send search engines mixed signals.
